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ABSTRACT 



We study the problem of interdicting components of an adversary’s system, 
e.g., a war-time economy, a transportation network, etc. Basic techniques are 
developed and illustrated with a simple network interdiction problem, “maximizing 
the shortest path” (MXSP). In MXSP, an interdictor wishes to employ limited 
interdiction resources as effectively as possible to slow an adversary in moving 
between two network nodes. “Interdiction” destroys a network arc entirely or 
increases its effective length through an attack. This bi-level, max-min problem is 
formulated as a mixed-integer program (MIP), but unique decomposition 
algorithms are developed to solve the problem more efficiently than standard 
branch and bound. One algorithm is essentially Benders decomposition with 
special integrality cuts for the master problem. A second algorithm uses a new set- 
covering master problem, and a third is a hybrid of the first two. We extend our 
techniques (/) to solve general system-interdiction problems, some of which cannot 
be formulated as MIPs, (/7) to solve system-defense problems where critical system 
components must be identified and hardened against interdiction, and (Hi) to solve 
interdiction problems with uncertain interdiction success. We report 
computational experience for MXSP, a shortest-path network-defense problem 
and MXSP with uncertain interdiction success. 
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I. INTRODUCTION 



This doctoral dissertation investigates what we call “The System Interdiction 
Problem,” (SI), and “The System Defense Problem,” (SD). In SI, an “adversary” tries to 
maximize the utility of his system (modeled as general linear or integer programs), and 
an “interdictor,” with limited assets, tries to minimize that maximum by limiting the 
adversary’s feasible actions, or by increasing the cost associated with his activities. As in 
a zero-sum Static Stackelberg Game (see Simaan and Cruz, 1973, for the definition of 
Stackelberg strategy), we assume that the interdictor {leader) first chooses his actions and 
only after that the adversary {follower) decides how to operate the system, as best 
possible, given the effects of the interdiction. SD extends that methodology to plan 
effective “hardening” (defense) of a system to minimize the effects of subsequent 
interdiction. In SD, the players change sides; The leader is the system user who first 
chooses his defense actions and only then the interdictor, now the follower, chooses his 
interdiction plan. 

Throughout this work, we have a special interest in the problem of interdicting (or 
defending) a road or other transportation network in order to maximize the post- 
interdiction shortest-path length between two specified nodes. In this problem, a 
“network user” wishes to traverse a path of minimum length (or minimum time, 
minimum cost, etc.) between two specified nodes, s and t, in a directed network. But, by 
first attacking the network using limited resources, an interdictor can destroy certain arcs, 
or increase the effective length of certain arcs, and thereby increase the minimum length 
in the a priori network. 
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(a) Maximizing the Shortest Path (MXSP) is the interdictor’s max-min problem; 
Subject to a limited interdiction budget, interdict arcs in a network so as to 
maximize the shortest-path length between nodes s and t. 

(b) Defending the Shortest Path (DSP) is the network user’s min-max-min problem: 
Subject to a limited defense budget, harden arcs against interdiction so as to 
minimize the post-interdiction shortest path, given that the interdictor will 
optimize his interdiction plan with knowledge of which arcs are hardened. 
Hardened arcs are assumed invulnerable. 

In the rest of this chapter, we formulate SI and SD as mathematical programming 
problems, and motivate some new approaches for solving those problems. 

A. SYSTEM INTERDICTION 

The system interdiction problem is a generalization of network interdiction 
problems, which have received considerable attention over the years. First were the 
military applications, like interdiction of ground-forces transportation (e.g., Ghare, 
Montgomery and Turner 1971, McMasters and Mustin 1970, Golden 1978, Fulkerson 
and Harding 1977), and lately drug interdiction efforts have triggered more research (e.g.. 
Wood 1993, Washburn and Wood 1994). Today, military and civilian systems are 
becoming even more complicated and interdependent, so interest in interdiction of 
“general systems” arises, too (Chem and Lin 1995). 

The system interdiction problem is a model for the following scenario: Two 
opposing forces, a leader (interdictor) and a follower (adversary), are involved in a 
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warlike conflict. We assume that the follower operates a “system,” with its optimal 
operation represented adequately by the solution to a linear program. (Later we extend 
our results to interdiction of systems represented by more general optimization 
problems.) Thus, the follower’s problem, with no interdiction, is simply 

maxjc^y |/4y <b,0<y <u|where c,y,ue9?”, b elR'" ,^4 efH'"’'" and is the 

transpose of the column vector c (we assume that the follower’s problem is feasible). On 
the other hand, the interdictor tries to minimize the follower’s objective value by 
preventing the use of some of the follower’s possible activities, indexed by j. Let the 

feasible set for the leader be X= |x 6 { 04 }”|^^r|. Xj =1 means that activity j is 

interdicted and i?x < r represents the restrictions on interdiction resources (we assume 
that X is not empty). 

The system interdiction problem finds the optimal interdiction strategy x* for the 
leader. The optimal solution for the follower given x*, denoted by y*, is not particularly 
important. Two special instances of SI are: 

(a) Interdiction of a max-flow network system (e.g., Ghare, Montgomery and Turner 
1971, Wood 1993) is a situation where the follower maximizes flow through a 
capacitated network, while the leader, with limited interdiction resources, can 
break some of the network’s arcs (a broken arc has no capacity), and 

(b) The k-most-vital-arcs problem (Corely and Shaw 1982, Malik et al. 1989) is a 
special case of MXSP where the interdictor seeks to destroy exactly k arcs to 
interdict the network most effectively. 
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Let f/= diag(u). Then, The Linear System-Interdiction Problem (LSIP) is defined 



to be the following leader’s problem: 
[LSIP] min max c^y 

xeX y^Y(x) 



where 



X = |x e { 04 }” Rk < rj, 



and 



7(x) = {y I v4y < b, 0 < y < 17(1 - x)] 



The follower uses activity j at level yj. By interdicting activity j, the leader changes the 
upper bound on yj from Uj to 0, i.e., forces the follower to accept =0 (we assume that 
7(x) is not empty for all feasible x eX). 

Remark; In Appendix B we show that [LSIP] is equivalent to a more general system 
interdiction problem where F(x) = {y|/4y + Bx < bjand where the leader can change the 

cost of the follower’s activities as well. This general case allows any single interdiction 
by the leader to affect one or more of the follower’s possible activities and available 
resources. For instance, in MXSP, one interdiction attempt might increase the length of 
several arcs and/or delete one or more nodes from the network. 

Formulation [LSIP] is a structured case of the Bi-Level Mixed Integer 
Programming Problem (BLMIP). (See Ben-Ayed 1993 for an introduction to BLMEPs.) 
However, the general BLMIP does not assume a max-min conflict as in LSIP, and the 
objective functions of the leader and the follower may have much in common in the 
BLMIP, rather than being in direct opposition. For instance, the leader and follower may 
represent two levels of decision makers in the same company, and therefore they have 
similar, although not identical, goals. 
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In Appendix A existing algorithms for BLMDPs are explored, and it is shown that 
none of those algorithms is appropriate for large instances of LSIP. Some of the 
algorithms (Bard and Moore 1992, Wen and Yang 1990) use a positive approach, which 
means that they work better when there is strong correlation between the leader’s and 
follower’s objective functions. Such algorithms are likely to be inefficient when applied 
to max-min problems such as LSIP. Two other BLMIP algorithms (Moore and Bard 
1990, Vicente et al. 1996) may not be directly positive, but they rely on solving bi-level 
linear programs (BLLPs) which are nominally solved using a positive approach. In fact, 
only three exact algorithms for BLLPs have been tested on relatively large problems 
(Bard and Moore 1990, Hansen et al. 1992, Judice and Faustino 1992), and all of these 
algorithms use a positive approach. A few exact algorithms (Vaish and Shetty 1977, 
Anandalingam and Apprey 1991, Onal, 1993) use what appears to be a non-positive 
approach, but none of these algorithms have been tested on large problems. Finally, we 
note that no extant algorithm in the bi-level arena, exact or heuristic, is designed to take 
advantage of the special max-min structure of LSEP, or the special shortest-path structure 
ofMXSP. 



B. REFORMULATION 

Formulation [LSIP] is difficult to solve, as we shall see, and a reformulation is 
needed. In order to see the difficulties with [LSIP], notice first that being able to solve 
[LSIP] when x is continuous would be useful, because: 

(a) We would be able to use a branch-and-bound procedure to solve [LSIP]. 
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(b) The relaxed problem has a solution at an extreme point of the convex hull of X, 
C{X) (Bazaraa, et. al., 1993). Hence, if we relax the binary constraints x e {0,1}" 
so that 0 < X < 1 , and all the extreme points of C{X) happen to be in X, then we 
can relax the binary constraints and still be guaranteed an optimal (binary) 
solution. For instance, this would be the case when X= { x e {0,1}”, lx < ro} ). 



However, solving the relaxed problem isn’t easy in general. Let 

T 

M's) = max c y so that formulation [LSIP] is equivalent to min A (x) . When we relax 

ygy(x) xeX 

the binary constraints in X, f^(s) is a concave function, because the choice of x changes 
only the right-hand side of the follower’s LP. Hence, we may have local optima. In fact, 
the problem [LSEP] is extremely difficult to solve and even the relaxed problem is 
strongly NP-hard (Hansen, Jaumard and Savard 1992). 



Example 1.1 

To illustrate the “bad behavior” of the relaxation of [LSIP], let the follower’s 
problem be represented by; 

[EXl] 



max 

y 


yi + 


y2 




s.t. 


>^1 




<5 






y2 


<5 




yi - 


y2 


<4 




-yi + 


y2 


<3 



yi > 0 , y2 > 0 , 



The system’s value (without any interdiction) is 10. Assume that the leader can interdict 
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either yi or yy, of course, he wishes to minimize the maximum value of + y >2 after 

interdiction. If the leader interdicts ji, the follower solves 

[EXla] max yi + y 2 

y 

s.t. yi <0 

yi ^5 

yi - yi :S4 

-yi + yi ^3 

Jl >0, ^0, 



and hence obtains a value of 3. In the same way, if the leader interdicts j 2 , the value of 
the system is 4. In this simple example, the optimal solution for the leader is to interdict 
y\. Now, let’s see what happens when we relax the binary constraint on the interdiction 
variables. Let y\ be interdicted hy p and yi be interdicted hy p, 0 < /? < 1 . The 
parametric problem the leader solves is: 

[EXlb] min f^{p) 

Q<p<\ 



s.t. 



: yx-^ yi 




y\ 


<5p 




VI 


y\ - 


<4 


- + y2 


<3 


V 

IV 

O 


^0, 



and fxip) has a global minimum at /? = 0 and a local minimum at p = 1 . (See Figure 

1.1 )■ 
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Aip) 




Figure 1.1: The value of the system of Example 1.1 as afimction of 
p, as given by formulation [EXlb]. 



As we expect, A^p) in Example 1.1 is a concave function, which is not easy to 
minimize. In order to overcome this problem, we reformulate the system-interdiction 
problem. The idea is to leave the feasible region of the follower independent of x and, 
instead, add a penalty term in the follower’s objective function for any use of interdicted 
activities. The new formulation is convex, for continuous x, and a local optimum is a 
global optimum, too. 

We prove in Chapter HI that there exists a finite penalty multiplier v * , such that 
for all V > V * the following is equivalent to formulation [LSIP]: 

[LSIP-1] min max c^y-x^Vy 

xeX yey 



where 



X 

Y 

V 



= {xs{04}" 



fe < r| 



= {y I Ay < b, 0 < y < u}, 
= diag(vl). 



and 
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Let A(x) = max{c^y-x^yy} so that [LSIP-1] is equivalent to min A(x) . The 
yeY ' xeX 

equivalence of formulations [LSIP] and [LSIP-1] means that ^(x) = /i(x) for all x eX, 

T' 'T' T' 7' T* 

and so if y(x) e argmax {c y-x Vy}, then x Vy = x y = 0 and _^(x) = c y(x) is not 
yer 

actually a function of v. 

Notice that when we relax the binary constraints inX, fiOO is a convex function, 

and that the feasible region of the follower’s problem is independent of the interdiction 

plan. More importantly, from basic linear programming theory we can reformulate 

[LSIP-1] to min{z \z >c^y-x^Vy Vy €7'} where Y' is the set of extreme points of 
xeX 

7 = {y I /4y < b, 0 < y < u}. This suggests solving [LSIP-1] with a row generation 

algorithm, which is essentially Benders Decomposition (Benders 1962). In this 
algorithm, the inner minimization is a subproblem that generates extreme points of 7. 
The master problem is a relaxation of [LSIP-1] that approximates fro*ri below, with 
cuts constructed from those extreme points. Actually, this algorithm has already been 
developed and applied to the max-flow network-interdiction problem (Cormican 1995). 

Given an interdiction plan x and the solution y(x) of the associated subproblem, 

the new cut in the master problem, z > c y(x) - x Vy(x), will be “reasonably tight,” i.e., 
will give a good approximation of ^(x) for xeX,x^ x,if we have a valid, but small, 
penalty multiplier v. For instance, in the max-flow network interdiction case v = 1 is 
always valid and gives tight cuts. However, in another system-interdiction problem, the 
minimum valid value of v could be difficult to calculate. A “large enough” penalty can 
be easy to define — / 2 ( 0 ) will work for some problems — but such a penalty can be much 
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larger than necessary. On the other hand, if we guess and we guess too low, we might 
terminate with an incorrect solution and not know it (see Example 3.1 in Chapter IDT). If 
we guess and we guess too high, the running time of the decomposition algorithm will be 
excessive, due to the loose cuts. 

The Benders decomposition algorithm is discussed in detail in Chapter II (for the 
MXSP scenario) and in Chapter HI (for more general system-interdiction problems). 
We also develop a second decomposition algorithm, which is a variant of the Benders 
decomposition that assumes no bound on the penalty multiplier v in [LSIP-1], and 
describe a hybrid decomposition algorithm that is a combination of the first two. The 
second and third algorithms appear to be superior to the first for MXSP. 

Example 1.1 (revisited) 

We can reformulate Example 1.1 in the form of [LSIP-1] and obtain an 
equivalent (for /? = 0 and /> = !), but convex formulation. We’ll do so with two 
penalties, v = 2and v = 10, to show the difficulties that a large penalty may cause. When 
we relax the binary constraints, the corresponding parametric linear program is: 

[EXlc] min / 2 O) 

0<p<\ 

where /j (p) = max >^i + >^2 - v ((I-/?) yi+pyi) 
y 

s.t. yi <5 

yi ^5 

yi - y 2 ^4 

- yi + yz <3 

yx >0, y 2 >0. 

As can be seen in Figure 1.2, for both values of v the solution of the inner 
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maximization problem, as a function of p, is convex and matches ^(/?) for p = 0 and 
= 1 . However, for v = 10, the relaxation is much less useful. Assume we start the 
decomposition algorithm we mentioned earlier, with /? = 0 . The two cuts the 
subproblem would produce, for v = 2 and v = 10, are shown in the graph. The cut using 
V = 2 gives a tighter bound on for p- \ and clearly that difference will become 
more significant in more realistic and multi-dimensional problems. ■ 




Figure 1.2: Relaxation of different formulations for Example 1.1. The 
relaxation using formulation [LSDP] is concave while the relaxation using 
formulation [LSEP-l] is convex. When solving formulation [LSIP-1] with 
Benders decomposition, the cuts in the master problem are tighter for v = 2 
compared to v - 10. 
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c. 



SYSTEM DEFENSE 



The system-defense problem is a natural extension of the system-interdiction 
problem. When a system user expects his system to be interdicted, he may wish to 
expend resources to protect that system to mitigate against the effects of interdiction. 
The question SD addresses is: How should a system user (now also called the 
“defender”), with limited resources, “harden” the components of his system to best 
protect against interdiction, given that the interdictor will optimize his interdiction plan 
with knowledge of those improvements? 

Let the set of feasible defense plans for the system user be given by 
G = {gs{0,ir |flg£h> (we assume that G is not empty). We assume absolute 
protection so that =l implies that activity j is fully secured against interdiction. SD 

finds the optimal interdiction strategy for the system user, g*, and the value of the system 
associated with this defense plan. Formally, the Linear System-Defense Problem (LSDP) 
is defined as the following problem for the system user: 



[LSDP] max min max c y 

geG x€X(g) yey(x) 



where 



G ={ge{0,l}" |Ffg<h}, 

■Y(g) = |x e {0,1}” < r, 0 < X < 1 - gj, and 

3^(x) = (y I /4y < b, 0 < y < U{1 - x)}. 



[LSDP] can be viewed as a min-max linear system-interdiction problem where the 
system user is the leader, the interdictor is the follower, and for every feasible defense 
plan g, the associated value of the system is given by a solution to a system-interdiction 
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problem where the protected activities are invulnerable (however we assume that X(g) is 
not empty for all g e G). Thus, in SD the leader interdicts the interdictor. Notice that a 
linear program can no longer represent “the system.” However, when the defended 
system is represented by a linear program (as in our formulation of [LSDP]), we can 
solve the overall system-defense problem through a nested decomposition algorithm, 
using one or more of the decomposition algorithms developed for [LSIP.] 

Example 1.1 (revisited) 

Assuming that the system user can protect one of his activities, y\ ory 2 , it is clear 
that he should protect ji. However, in more complicated problems, devising the optimal 
defense plan is much more difficult, and actually the system defense problem is NP-hard 
and not known to be in NP. ■ 

D. OUTLINE 

In this introduction, we have defined the system-interdiction problem, which is a 
difficult-to-solve bi-level mixed-integer programming problem. The continuous 
relaxation of the first formulation we gave for LSIP is a concave function in the 
interdiction variables, so even the relaxed problem is difficult to solve. Therefore, we 
introduced a second formulation of SI that is equivalent to the first for binary interdiction 
decisions, but is convex when we relax those binary constraints. The second formulation 
uses a penalty term in the objective function that prevents the follower from using 
interdicted activities. Unfortunately, this formulation may not be useful if a valid, 
sufficiently small penalty multiplier, is hard to find. 

In Chapter II we develop three decomposition algorithms for solving the 
problem of Maximizing the Shortest Path (MXSP) in a directed network. Computational 
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results for those three algorithms and an MIP formulation of the problem are provided, 
and practical techniques to speed convergence of the decomposition schemes are 
described and demonstrated. 

In Chapter III, we extend the models and methodology of Chapter n to solve 
interdiction problems defined on systems modeled as general linear or integer programs, 
not just networks. We use: 

(a) A decomposition algorithm that is based on a finite and “good” penalty multiplier, 

(b) A decomposition algorithm that assumes no finite bound on the multiplier, or 

(c) A decomposition algorithm that is a hybrid of first two. 

In Chapter IV, we discuss the system-defense problem, and solve it using a 
nested decomposition algorithm. Throughout the Chapter, we use the problem of 
Defending the Shortest Path (DSP) as an illustrative example, but the approach and 
development is valid for general SD as well. Computational results for DSP are given, 
and practical techniques to speed convergence of the nested decomposition schemes are 
demonstrated. 

Finally, Chapter V extends our approaches further, to one example of “stochastic 
system interdiction,” a case where interdiction successes are uncertain. As expected, this 
problem is harder to solve and so we suggest several approximation algorithms that are 
based on the three decomposition algorithms developed earlier. Preliminary 
computational experience is reported for a stochastic shortest-path network-interdiction 
problem, but the suggested algorithms can be used for other stochastic system 
interdiction problems, too. 
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n. SHORTEST-PATH NETWORK INTERDICTION 



Network-interdiction problems involve two opposing forces, a leader and a 
follower, who are engaged in a warlike conflict. The follower operates a network so as to 
optimize his objective function which involves moving a supply convoy through the 
network as quickly as possible, or maximizing the amount of materiel transported 
through the network subject to capacity constraints, etc. The interdictor tries to restrict 
the follower’s achievable objective value by interdicting (attacking) arcs so as to destroy 
those arcs entirely, or increase their effective length, reduce their capacity, etc. The 
purpose of this chapter is to develop new models and solution methods for the problem of 
interdicting a road or other transportation network in order to maximize the (post- 
interdiction) shortest-path length between two specified nodes. 

The topic of network interdiction has received some attention over the years, 
initially with military applications. For instance, McMasters and Mustin (1970) and 
Ghare et al. (1971) develop methods for interdicting a capacitated supply network to 
hinder the movements of enemy troops and materiel. More recently, research was 
triggered by drug interdiction efforts (Wood 1993, Washburn and Wood 1994) and by the 
need to assess the vulnerability of information networks to interdiction (Grbtschel et al. 
1992, Medhi 1994). 

The network-interdiction problem we focus on is Maximizing the Shortest Path 
(MXSP) (Fulkerson and Harding 1977, Golden 1978). In this problem, a “network user,” 
i.e., the follower, wishes to traverse a path of minimum length (or minimum time, 
minimum cost, etc.) between two specified nodes, s and t, in a directed network. But, by 
first attacking the network using limited resources, an interdictor, i.e., the leader, can 
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destroy certain arcs, or increase the effective length of certain arcs, and thereby increase 
that minimum length. MXSP is the interdictor’s problem: Subject to a limited 
interdiction budget (and possibly other restrictions), interdict arcs in a network so as to 
maximize the shortest-path length between nodes s and t. 

In our definition of MXSP, arc interdiction involves a binary decision with known 
resource consumption and assured success. The k-most-vital-arcs problem (Corely and 
Shaw 1982, Malik et al. 1989) is a special case of MXSP where the interdictor seeks to 
destroy exactly k arcs to interdict the network most effectively. Since that problem is 
NP -complete (Ball et al. 1989), it follows that MXSP is NP-complete. 

The A^-most-vital-arcs problem has received limited attention and we are not aware 
of effective algorithms for solving it. Malik et al. (1989) suggest a potentially effective 
algorithm for the problem, but the algorithm has a theoretical flaw as we discuss in 
Section C. Corely and Shaw (1982) suggest an algorithm for the single-most-vital-arc 
problem but this problem is a very simple case of MXSP which is solvable in polynomial 
time. 

Unlike the A:-most-vital-arcs problem, MXSP allows general resource constraints 
which, most significantly, enable the modeling of different types of interdiction 
resources, e.g., ground troops, aerial sorties, cruise missiles, etc. Fulkerson and Harding 
(1977) and Golden (1978) have studied a simpler variant of MXSP incorporating a single 
type of interdiction resource and arc lengths that increase linearly with the amount of 
resource applied. We believe that our model with discrete interdiction variables is more 
realistic. 
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In this chapter, we first show how to model MXSP as a mixed-integer program 
(MIP). It is intuitively clear, and later demonstrated by computation, that this MIP can be 
very difficult to solve directly using LP-based (linear-programming-based) branch and 
bound. Therefore, we devise three decomposition-based algorithms for MXSP and 
demonstrate their computational effectiveness. The first algorithm implements a Benders 
decomposition (Benders 1962) that solves MXSP much like Cormican (1995) solves a 
maximum-flow network-interdiction problem. This technique converges slowly, as does 
branch and bound applied to the basic MIP, when interdictions cause large local delays. 
The second decomposition algorithm does not suffer as much from this problem. That 
decomposition (a) simplifies the master problem of the first algorithm to a set-covering 
problem (SCP), (b) improves efficiency by incorporating a greedy heuristic for the SCP 
(in addition to using an exact algorithm), and (c) exploits the special structure of shortest- 
path problems to gain efficiency. The last algorithm we devise is a hybrid of the first 
two. 

A. THE BASIC MODEL: MXSP AS A MIXED-INTEGER PROGRAM 

The mathematical programming formulation of MXSP on a directed graph 

is: 

Problem: Maximize the shortest-path length in a directed network by 

interdicting arcs. 

Indices: i e N, nodes in G (s is the source node, t is the sink node), 

A, arcs in G, 

k e FS(i) (k e RS(i)) arcs directed out of (into) node /, 
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Data; 0 < < oo, nominal integer length of arc k, 

0 < Jfc < 00 , added integer delay if arc k is interdicted, 
r vector of available interdiction resources, 

R matrix of interdiction-to-resource conversions, 
Variables; =1 if arc k is interdicted by the leader; else Xk =0, 
yk=\ if arc k is traversed by the follower; else =0, 

Formulation: 



[MXSP - P] max min ^ + Xkdk )yk 

y keA 



i = s 



s.t. 



keFS{i) keRS(i) 



0 

-1 



i ^N-s-t 
i = t 



yk>0 Vite^ 



where X = |x e 



Rs.<t 




(a) Node s is the source node and t is the terminal node, 

(b) The set of arcs directed out of node i is denoted “FS(f)” and the set of arcs 
directed into node / is denoted “RS(i)” 

(c) Xk=\ implies arc k is interdicted; else Xk =0, 

(d) Flow-balance constraints (1) in variables y route one unit of flow from s to t; the 
inner minimization is a standard shortest-path model with arc lengths Ck + Xk dk, 

(e) Ck is the nominal length of arc k and Ck + dk is the length of that arc if it is 
interdicted; dk is finite and comprises such factors as repair time or the length of a 
local detour (the case of <4 = oo is dealt with later). 
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(f) < r is a set of side constraints on interdiction resources; thus, X represents the 
set of feasible interdiction plans (we assume that X is not empty), 

(g) All data are assumed integral, and dk,cic>0\/k eA, 

(h) All solutions will be assumed to be integral since variables x are required to be 
integral and extreme points of the inner minimization are well known to be 
integral. 

To simplify presentation, and without loss of generality, we make the further assumption: 

Assumption 2.1: ITie interdictor has insufficient resources to disconnect s from t. ■ 

This assumption is innocuous and merely simplifies presentation of our algorithms. 
All of the algorithms are easily modified to identify the degenerate case in which s and / 
can be disconnected. The extensions of our techniques to handle undirected networks 
and/or node interdiction are also straightforward. 

If we fix X, take the dual of the inner minimization in [MXSP-P], make a few 
simple modifications and then release x, the following MIP results: 

[MXSP-D] 2 *= max 

X,7l 

s. t. Ttj - TCi - d^Xk < Cjt \/k = (i,j) e A 

TTs^O 
X &X 

Note that = 0 may be assumed because the inner minimization of MXSP has at least 
one redundant flow-balance constraint (as do all network flow models containing a 
balance constraint for each node). Also, note that the dual variables 7t are unconstrained 
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in sign and, having reversed their signs compared to the usual convention, we may 
interpret ti, as the post-interdiction shortest-path distance from s to i. 

[MXSP-D] is essentially the model explored by Fulkerson and Harding (1977) 
and by Golden (1978), except that their variables x are continuous and only a single 
resource constraint is allowed. Thus, that model is a simple linear program (LP). 
Fulkerson and Harding (1977) suggest solving the dual of that LP which may be 
interpreted as a parametric min-cost flow model. This approach does not appear to be 
useful when we relax the binary constraints in [MXSP-D] because their model does not 
allow any additional constraints such as x < 1. 

In theory, we can solve [MXSP-D] using a standard LP-based branch-and-bound 
algorithm. However, especially when possible delays dk are large, the LP relaxation of 
the model is weak and this results in excessive enumeration and unsatisfactory 
computation times. We use a decomposition approach instead. 

B. A BASIC DECOMPOSITION ALGORITHM 

Our basic decomposition algorithm to solve MXSP is a direct application of 
Benders decomposition to [MXSP-P] (or [MXSP-D] as a MIP, e.g., Garfmkel and 

Nemhauser 1972, pp. 135-143). Let y g{ 04}^ denote an arc-path incidence vector 
corresponding to an s-t path P, i.e., ^ implies arc k is in P; otherwise, = 0. 

^(y)= the length of the path y. Let Y denote a collection of arc-path 

k&A 

incidence vectors corresponding to a subset of all simple s-t paths in G. For simplicity, 
we refer to y as “a path” and Y as “a set of paths.” Also^, let D = diag(d) and define: 
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^Master(J^ - 1 j 



max 

xeAT 



z 



z^ = 



s.t. z<c^y + j.^Dy VyeF 



[SP - Sub(x)] z- = min 2^ (c^ + Xkdf, )y^ 
y keA 



s-t. Y^yk- ^Zyk=' 

k€FS(i) keRSiO 



^ I 


i = s 


0 


i gN- s-t 


-1 


i = t 



yf. >0 k eA 

Let Y denote the set of all simple s-t paths. For fixed x = i , a solution to the 
inner minimization of [MXSP-P], which is [SP-Sub(x)], always occurs at a path y. 

Therefore, [Master(F)-l] is equivalent to [MXSP-P] when Y = Y. However, we hope to 
solve [MXSP-P], at least approximately, by sequentially generating only a small fraction 
of the extreme points of T in a decomposition algorithm: 



Algorithm 1: Basic Benders decomposition algorithm for MXSP. 

Input; An instance of MXSP and allowable optimality gap s. 

Output; Interdiction plan x* that solves MXSP to within e units of optimality. 
Step 0: 7 <- 0, r < — oo, f oo, i <- 0. 

Step 1; Solve [SP-Sub(x)] for solution y with objective rj. 

Y <^Y^y. 

If z < then x'<— i and z ■<— Zj . 

Step 2: Solve [Master(F)-l] for solution x with objective z^ 

Z <- Zy. 

If z -z > 8 then go to Step 1 . 

X* <— x', print x* and stop. 



Step 3; 
Step 4; 
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The correctness of the algorithm, as in any Benders decomposition algorithm, is 
based on the following observations; 

(a) The sub-problem (which is simply a shortest-path problem here) finds an optimal 
follower’s reaction for a specific leader’s interdiction plan i. Hence, gives a 
lower bound on the leader’s optimal solution value. This bound is finite because 
of Assumption 2.1. 

(b) If the sub-problem produces the same s-t path twice, the upper bound and the 
lower bound must match and the algorithm terminates. If the sub-problem 
continues to find new paths, the algorithm must converge in a finite number of 
iterations because the number of simple s-t paths is finite. (The number of paths 
and thus the number of iterations may be exponential, however.) 

(c) When Y includes all simple s-t paths, [Master(T)-l] is clearly equivalent to 
[MXSP-P]. Otherwise, when 7c7, [Master(7)-1] is a relaxation of [MXSP-P] 
and thus, z-^ is an upper bound on the interdictor’s optimal objective value. Note; 

The master problem constraints defined with respect to V are called “Benders 
cuts.” 

(d) To tighten the relaxation of [Master(7)-1], we next introduce “integrality cuts.” 

Proposition 2.1; For every Benders cut z < c^y + x^Z)y, the integrality cut x^y > 1 is 
valid whenever z > c^y . 

Proof: Note that each such Benders cut implies that z* < c^y + x*^Dy. Furthermore, 
either x*^y = 0 or x*^y >1. If x*^y = 0 given that z > c^y, then z* < c^y + x*^Dy = 
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c^y + 0 < z, which is a contradiction. Therefore, x*^y > 1 which implies that x^y > 1 is a 
valid integrality cut. ■ 

Corollary 2.1: For every Benders cut z < c^y + x^Dy, the integrality cut of Proposition 

2.1, x^y > 1, can be tightened to x^y > 2 if z > c^y + maxrf^y^ , it can be tightened to x^y 

k 

> 3 if z > c^y + max { dk y^+ dk; y ^-' }, and so forth. ■ 

k^k' 

Naturally, as z is updated in the algorithm, we may be able to tighten previously 

generated integrality cuts using Corollary 2.1, too. Actually, in our implementation, we 

add the cut x^y > 1 even if z = c^y (or x^y > 2 even if z = c^y + maxr/^y^, etc.). If the 

k 

optimal solution value exceeds the current value of z, those cuts are valid. But, if those 
cuts render the master problem infeasible, the algorithm can be terminated with the 
incumbent x' being optimal. 

We also improve the effectiveness of Algorithm 1 by not solving the master 

problem to optimality. This well-known variant of Benders decomposition (e.g., 

Geofffion and Graves 1974) is guaranteed to converge as long as every sub-optimal 

integer solution y satisfies c^y > z (recall that data are integral), and we do not update z 

unless the master problem is solved to optimality. 

Since all dk are assumed finite. Algorithm 1 does not allow the interdictor to 

completely remove (destroy) an arc. To model the effect of complete arc removal, we 

can solve the sub-problem with interdicted arcs eliminated, while in the master problem 

we may be able to define a “sufficiently large” artificial delay (say |A/’|max ) on 

k 

every interdictable arc to keep the Benders cut valid. But, as we shall demonstrate 
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empirically, the run time of the algorithm grows very quickly with the size of that delay. 
On the other hand, being too conservative with that artificial delay can lead to difficulties 
as seen in the following example. 



Example 2.1 

Consider the network of Figure 2.1 and an interdictor who can remove any two 
arcs from that network. One obvious optimal solution to MXSP for this network is to 
interdict (5,a) and (s,b) so that the shortest s-t path has length 20. Now, let d denote the 
artificial delay that is to be added to interdicted arcs and suppose that we use Algorithm 
1, without integrality cuts, to solve this problem. 

Initially, the algorithm finds the uninterdicted shortest path s-a-t with length 2. 
Given that solution for the follower, the leader interdicts (5,a) and (a,t) and the “upper 
bound” (as calculated in Step 2) is 2 + Id, which is valid only if J > 9. In the next step 
the follower finds the shortest path after (5,a) and {a,i) are removed from the network. 
The solution is s-b-t, with length 12. The two Benders cuts in the master problem are: 



z < 2 + dxsa + dxat from the first iteration, and 



z < 12 + dxsb + dxbt from the second iteration. 




Figure 2.1: Network to illustrate difficulties with artificial delays. Numbers 
next to arcs are lengths. 
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There are four cases to consider now; 



(a) \^d<5, the shortest path from the second iteration has length greater the pseudo- 
upper bound from the first iteration. We conclude then that d is too small, 
increase it and return to the master problem. 

(b) If 5 < d < 10, the master problem objective is 12. Since the lower bound and 
pseudo-upper bound match, the algorithm terminates, but with an incorrect 
solution. In this case, we see no way to recognize that d is too small without 
solving this NP-complete problem; Does there exist a solution to MXSP with 
objective value greater than Zyl 

(c) If 10 < if < 18, the master problem interdicts both paths and has optimal objective 
value 1+d. The third iteration of the sub-problem finds the path s-c-t with length 
20, which is larger than the current pseudo-upper bound. Again, we conclude that 
d is too small, increase it and return to the master problem. 

(d) If if > 18, the upper bound is valid and the algorithm terminates with the optimal 
solution. ■ 

C. A SECOND DECOMPOSITION ALGORITHM 

Of course, case (b) of Example 1 is the most disturbing. To overcome this 
difficulty, we offer a second decomposition algorithm. This algorithm derives from the 
variant of Benders decomposition (mentioned earlier) in which the master problem is 
solved for any feasible solution with objective value greater than the current lower bound. 
The algorithm iterates until no such solution exists; at that point, the best solution found 
must be optimal. For simplicity, we now assume that every interdicted arc is completely 



- 25 - 



removed from the network. No loss of generality arises since arcs with finite delay are 
easily handled; For any arc k with dk< ’x> and nominal length Ck, create two parallel arcs, 
k\ and k 2 . Arc k\ has length Ck and is interdictable, i.e., “removable.” Arc k 2 is non- 
interdictable and has length Ck-^dk. 

The master problem of the new algorithm simply seeks a feasible solution with 

objective greater than the current lower bound, z = maxc y . 

yeY 

[^Master(i^-2aj Find xeX 

s.t. z<c^y + 'sJDy VyeT 
z>z + \ 

(Note that z > z +1 is sufficient since all data are assumed to be integral.) 

Proposition 2.2; For artificial delay d sufficiently large, x is feasible to [Master(7)-2a] 
if and only if x interdicts at least one arc in every path represented by Y . 

Proof; Sufficiency is guaranteed because c^y > 0 and d is large enough (we can assume 

d > z+1), and necessity follows because z = maxc y . ■ 

yer 

Instead of solving [Master(7)-2a], Proposition 2.2 allows us to solve the 
following set covering problem (SCP); 

[Master(}^ - 2b j Find x g X 

s.t. y^x>l Vye7 
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The algorithm we have just established is: 



Algorithm 2: A covering decomposition algorithm for MXSP. 

Input; An instance of MXSP. 

Output; An optimal interdiction plan x*. 

Step 0; Y <r-0,z< — oo, r <- oo, i <- 0. 

Step 1; Solve [SP-Sub(i)] for optimal solution y with objective value z^. 

f <-Yuy. 

If 2 < Z| then x' <- X and z <- Zf. 

Step 2: Attempt to solve [Master(T)-2b] for feasible solution x. 

If [Master(F)-2b] is feasible then go to Step 1. 

Step 3; X* <- x', print x* and stop. 



Let us add a bit of insight to Algorithm 2. Each time the algorithm reaches Step 
1, the network user suggests one new s-t path, the best with respect to the interdictor’s 
previous plan. Then, in Step 2, the interdictor tries to find a plan that interdicts all the s-t 
paths that have been exposed so far, paths represented by Y. This new interdiction plan 
may or may not force the network user to traverse a path longer than the current lower 
bound. Once the interdictor fails to interdict all the paths in Y, he knows that he cannot 
force a shortest-path length that is longer than the longest path in Y. But, this length is 
exactly the current value of z, so he concludes that no better interdiction plan than the 
incumbent x' exists, and the algorithm terminates. 

Algorithm 2 is similar to the algorithm for the A--most-vital-arcs-problem 
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suggested by Malik et al. (1989). There, paths with non-decreasing lengths in the 
uninterdicted network are enumerated and interdiction is attempted until the / shortest 
paths cannot be feasibly interdicted. In our setting, this means that an algorithm that 
produces the /^-shortest path in the original network (e.g., Katoh et al., 1982) replaces 
Step 1. However, the algorithm in Malik et al. assumes that an interdiction plan that 
interdicts the / shortest paths must correspond to a cutset in the sub-network created from 
the union of the arcs and nodes from those paths. Consequently, a solution x* 
corresponds to a minimum-cardinality cutset, which can be identified by solving a 
maximum-flow problem in the sub-network using arc capacities of 1. But, as illustrated 
next, the assumption is invalid — ^the master problem just described is a restriction of the 
correct one — and thus that procedure must be viewed as a heuristic. 

Example 2.2 

Consider the network of Figure 2.2, with all arcs of length 1, and suppose that the 
interdictor can remove any two arcs from the network. Clearly, the optimal interdiction 
removes arcs (5,c) and {c,t) and forces a shortest path of length 4. But, deleting two arcs 
crossing any cutset leaves a shortest path of length 2 or 3. ■ 




Figure 2.2: Network for Example 2. All arc lengths are 1. 
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The rest of this section describes several enhancements to Algorithm 2 to 
improve efficiency. 

# • • 'T 

When the set X includes only a single resource constraint, say r x < /*o, we can 
solve the following master problem in place of [Master(T)-2b]; 

[Master(y) - 2c] min r^x 

s.t. y^x>l Vy€T 

[Master(7)-2c] is a standard set-covering problem (SCP) and, if it has an optimal 
objective value less than or equal to tq, then [Master(F)-2b] is feasible. Of course, we 
need not solve [Master(7)-2c] to optimality, but just until r x < ro, and this suggests the 
use of efficient heuristics. We use a version of the simple greedy heuristic for SCPs 
discussed by, among others, Nemhauser and Wolsey (1988, pp. 466). Many other 
heuristics exist, (e.g., Beasley 1990, Caprara et al. 1996), but this one is easy to 
implement and provides more-than-adequate performance on our test problems. 

Whenever we need to solve a master problem in Algorithm 2, we run the greedy 
heuristic on [Master(7)-2c]. If a feasible solution, x s X, is found, we proceed to Step 1 
of the algorithm. If not, only then do we resort to an exact (and slower) branch-and- 
bound algorithm. 

When solving MXSP, Algorithm 2 typically iterates much faster than Algorithm 
1 because the master problems are much easier to solve. This is true even when potential 
delays dk are small. On the other hand. Algorithm 2 typically requires more iterations 
than Algorithm 1. Another problem with Algorithm 2 is that it incorporates no upper 
bound, and thus, it cannot be stopped early with a near-optimal solution. To help 
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overcome these two difficulties, we employ a local-search procedure. With this 
procedure, we can add more than one path to Y per iteration, and we can often determine 
an upper bound on the optimal solution value. 

Let z(y) denote the length of path y . The key idea behind the local search is that 

any path y with z(y) < z may be introduced into Y without compromising validity of the 
algorithm. This is true by definition of the lower bound. There are many ways to find 
more than one s-t path per iteration and we use the following procedure: It is well known 
that finding the shortest paths from 5 to all other nodes is not much more difficult than 
finding a shortest s-t path, so we first compute the former paths encoded using a standard 
“shortest path tree” and “predecessor function” (e g., Ahuja et al. 1993, pp. 106-107). Let 
P{i)={s, i\, h, ... ,in, 0 a shortest s-t path and let P(j) be a shortest path to node j. For 
every node im e{/i, h, ... , in), and for every arc (/,7m) in the network, we build the path 
(P(/), im, 7m+i, ... , in,t\ represented by its incidence vector y, and calculate the path’s 
length z(y). Hence, the procedure Local_Search(7) takes a shortest path tree T (derived 
from a shortest-path algorithm) as input and returns a list of paths. We omit pseudo-code 
for this procedure, and for Procedures Compare and Lift described below, because their 
implementations are straightforward given the in-text descriptions. 

Every path y returned from Local_Search with z(y) < z is introduced into Y as one 
more path to be covered in the master problem. If z(y) > z , the path is stored in a special 
set Y . Later, after updating z in succeeding iterations, we move any y e 7 into 7 if 

z(y) < z. Based on Theorem 3 below, the paths contained in 7^ can also be used to 
obtain an upper bound z on z* which then allows us to solve for e-optimal solutions. 
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Proposition 2.3: Let be a set of paths such that r(y) < z for all y g Y^. Then, if 
[Master(J^)-2b] is infeasible, z* <z . 

Proof: If z* > z , we can feasibly interdict all paths y such that z(y) < z . By assumption 
we cannot, so z* < z . ■ 

So, if we define the set }^ = {y e 7^| z(y) < z + e } and [Master(J^)-2b] is 

infeasible, we know that z* <z + e and the solution i that yielded z is s-optimal. 

Our implementation of Algorithm 2 uses two additional procedures that 
empirically speed convergence. The first procedure, Compare(7), returns all the “non- 
dominated paths” in Y. Path yi dominates path y 2 if all interdictable arcs in y 2 are also 
contained in yi, i.e., if every interdiction plan that interdicts yi also interdicts y 2 . 
Essentially, Compare implements one type of test for “row redundancy” in an SCP. 
Other redundancy tests are known (e.g., Garfinkel and Nemhauser 1972, pp. 302-304, 
Taha 1975, pp. 316-332) but this one is easy to implement and has proven to be effective. 

The second procedure, Lift(7, z), uses information about arcs with finite delays to 
tighten the SCP formulation. Recall that we replace each arc k with length Ck and finite 
delay dk with two parallel arcs; Interdictable arc k\ has length Ck and non-interdictable arc 
ki has length Ck + dk. Now, assume that we have a path y in 7, such that y includes arc 
ki and dk + z(y) < z. Then, a path y that is identical to y except that it includes arc ^2 
instead of k\ is longer, but is still shorter than the lower bound. Hence, yean be 
introduced into 7. Actually, this new path dominates y and can replace it, and we have 
thereby lifted the valid inequality y^x > 1 to y^x > 1. (This is, in fact, a “lift” since y < 
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y, = 1 and =0; see, for example, Nemhauser and Wolsey 1988, pp. 261-267.) The 

procedure Lift(y, z) returns the set of non-dominated paths generated from f after such 
replacements. Notice also that if we accept s-optimal solutions, by Proposition 2.3 we 
can introduce y into Y as long as z(y ) = + z(y) < z + 8. That is done by procedure 

Lift(T, z+e), which returns the set of non-dominated paths from Y with z(y) < z + 8. 



Algorithm 2, with all enhancements is outlined below. The actual 
implementation reorders certain computations for efficiency’s sake. 

Algorithm 2E: The covering decomposition of Algorithm 2, enhanced. 

Input; An instance of MXSP and optimality tolerance 8. 

Output: An 8-optimal interdiction plan x* for MXSP. 

Step 0; r ^ 0, Y^<r- 0, z ■< — qo, i ^ 0. 

Step 1: Solve [SP-Sub(i)] for shortest path tree T and objective zj. Ifz < zj 

then \'<r- i.,Z'<r-z^,Y Lift(7, z + 8). 

Step 2: Local_Search(7). 

Y'^{y e Y^\ z(y) <z + 1 }, Y^ Y^- Y'. 

Y'<r- Lift(r, z + 8). 

Y <r- Compare(7 u Y'). 

Step 3: Try to solve [Master(7)-2b] for optimal solution x. 

If [Master(7)-2b] is feasible, then go to Step 1. 

Step 4; X* <-x', print x* and stop. 
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It should be noted that LocaI_Search is also applicable to Algorithm 1. In fact, 
an s-t path derived by any means generates a valid Benders cut for this algorithm. A cut 
generated from an arbitrary path may be dominated if it contains some non-interdictable 
arcs, or if the path contains a cycle. Thus, a procedure analogous to Compare is also 
applicable to Algorithm 1. (Lift does not apply.) In practice, we find that Algorithm 1 
with these modifications requires fewer iterations, but total solution time increases 
because the master problems quickly become large and hard to solve. 

D. A HYBRID DECOMPOSITION ALGORITHM 

The final algorithm we suggest is a hybrid decomposition algorithm that 
combines the master problems of Algorithms 1 and 2. In this hybrid algorithm. 
Algorithm 3, we view the master problem of Algorithm 1 as the “basic master problem” 
and let master problem constraints of Algorithm 2 serve as integrality cuts for the basic 
master problem. Thus, the master problem of Algorithm 3 integrates the Benders cuts, 
the integrality cuts of Algorithm 1 and the covering cuts of Algorithm 2. In every 
iteration we add to the basic master problem one Benders cut, one integrality cut, and we 
update the set of covering constraints in this master problem using procedures 
Local_Search, Compare and Lift. 

Example 2.3 

Consider a network containing s-t paths Pi and P 2 , among others: P\ traverses arcs 
1, 2 and 3 and P 2 traverses arcs 1, 4 and 5. Those arcs have the following parameters: C\ = 
3, C2 = 1, C3 = 8, C4 = 4, C5 = 6, d\ =3, d 2 = 4, J3 = 5, J4 = 1, and ds = 3. Suppose that P\ is 
the shortest s-t path in the network, and hence is returned by the sub-problem in the first 
iteration of the decomposition algorithm. Then, the Benders cut we add to the master 
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problem is: 



Bendersi; 2 < 12 + 3xi + 4 x2 + 5x3. 

The integrality cut and the covering constraint associated with this Benders cut 
are identical: 

Integrality 1 : xi + X2 + X3 > 1 , 

Coveringi: xi + X2 + X3 > 1, 

both with “score” 12. (Additional cuts that might be generated by LocaI_Search are 
ignored.) The score is the uninterdicted length of Pi; this value is important for later 
tightening or lifting of these cuts. Note that Compare will not eliminate one of these 
constraints, nor would we want it to: A lifted integrality cut is different than a tightened 
covering constraint even though the base constraints are identical. 

Suppose that the interdictor has enough resource(s) to interdict arcs 1, 2 and 3 
together, and this is the solution (with 2 =24) of the first master problem, which consists 
of Bendersi, Integralityi and Coveringi. Further, assume that the shortest s-f path given 
these interdictions is P2 so that z = Ci + di + C 4 + = 16. In this case we can lift the 

previous covering cut because interdiction of arc 1 alone cannot “push” z over the lower 
bound z. (Formally, the difference between the score of Covering] and z exceeds di.) The 
cuts from the first iteration are now: 

Bendersi: z < 12 + 3xi + 4x2 + 5x3, 

Integralityi: xi + X2 + X3 > 1, Score =12, 

Coveringi: X2 +X3 > 1, Score = 15. 

The score of Coveringi has been updated to 15, which is the length of Pi with arc 1 
interdicted. (Note that we could also have lifted the basic covering cut to xi + X3 > 1, with 
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score 16 . In our implementation, however, we are satisfied with the first valid lift that we 
find.) 



The cuts from the second iteration are; 

Bendersi; r < 13 + 3 xi + 1x4 + 3 xs, 

Integrality2: Xj + X4 + X5 > 1, Score = 13 , 

Covering2: X4 + X5 > 1, Score = 16 . 

(Again, we ignore covering cuts potentially derived from Local_Search.) The score of 
Integrality2 is the uninterdicted length of P2 while the score of Covering2 is the length of 
P2 with arc 1 (only) interdicted. Now, suppose that the solution to the new master 
problem, which consists of the two Benders, two integrality and two covering cuts, is 
Xj= X3 = X4 = X5 = 1 and X2 = 0 . Thus, z =20 and the algorithm continues. 

Suppose then, at some later iteration, z increases to 17 . In this case, we can 
tighten the right-hand side of Integrality 1 to 2, because to push z over z we must interdict 
at least two of the three arcs in Pi. (Formally, the difference between z and the score of 
Integralityi exceeds max^^eP, ^^so lift the second covering cut, because 

interdiction of arc 4 alone cannot push z over z = 17 . The cuts from the first two 
iterations are now: 



Bendersi: 


z < 12 + 3 xi + 4x2 + 5x3, 


Integralityi: 


xi -1- X2 + X3 > 2, 


Score = 12 , 


Coveringi: 


X2 + X3 > 1 , 


Score = 15 , 


Benders2: 


z < 16 + 3 xi + 1x4 + 3 x 5 , 


Integrality2: 


Xi +X4 + X5 > 1 , 


Score = 16 , 


Covering2: 


1, 


Score = 17 . 
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The algorithm may or may not halt now depending on the other cuts that have 
been generated and the value of z obtained after solving the current master problem. ■ 

In practice, when using a single interdiction resource constraint, we do not use 
Benders cuts in early iterations. Instead, we heuristically solve the set-covering master 
problem of Algorithm 2 to suggest a new interdiction plan, as long as this is easy to do. 
Once the covering problem becomes difficult, or when we want to establish or update an 
upper bound, we solve the complete, hybrid master problem. If the problem is infeasible, 
or the value of the objective function (the new value of upper bound) matches the value 
of the lower bound, we are done. Otherwise, we proceed with the algorithm using the 
solution from the hybrid master problem. 



E. COMPUTATIONAL EXPERIENCE 

We use a set of random problems here to test the algorithms we have constructed. 

Several network structures are used, specified as follows; 

(a) There is one source node s and one sink node t. 

(b) There are wxw “inner nodes,” arranged in a grid of m rows and n columns. 

(c) There is an arc from s to all (inner) nodes in the first column, and there is an arc 
from all (inner) nodes in the last column to t. None of these Im arcs may be 
interdicted. 

(d) An arc exists from each node in row r and column c, i.e., in grid position (r,c) to 
the nodes in positions (r+l,c), (r-l,c), {r,c+\\ (H-l,c+l) and (r-l,c+l), assuming 
that nodes exist in these positions. All of these arcs are interdictable. Figure 2.3 
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gives an example of a test network with 9 = 3x3 inner nodes. 

(e) The basic data for each network is; 

1) m and n, 

2) the identity of interdictable arcs: the total number of potentially 
interdictable arcs is a = (n - 2)(5m - 4) + 2m — 2, but only a specified 
percentage p of the a arcs are chosen to be interdictable. Interdictable arcs 
are chosen at random; and 

3) ro, the total interdiction resource available. (We assume single type of 
interdiction resource.) 




2) when k is identified as interdictable; dk, uniformly distributed on [1,^^, 
and 

3) when k is identified as interdictable: r*, uniformly distributed on [l,r]. 
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Our algorithms are programmed in C using the CPLEX version 5.0 callable 
library (ILOG 1997) for exact solution of master problems, when needed. CPLEX is also 
used to solve [MXSP-D] directly. Default solver options are used except that “variable 
selection strategy” is set to “branch based on pseudo reduced cost” when solving the 
master problem in any of the decomposition algorithms. All computation is performed 
on an IBM RS-6000 model 590 computer with 512 megabytes of RAM. All running 
times displayed are averages across ten networks of identical topology, but with different 
random arc attributes. 

Note that in Algorithms 1 and 3, we do not solve the master problem to 
optimality, but rather for a feasible integer solution i that yields z > z. Experience 
indicates that, when the master problem becomes difficult, it is best to stop with the first 
such incumbent solution. On the other hand, the first incumbent does not usually 
generate a “good” cut in early iterations. Our implementation exploits this experience 
using a simple rule: If we have not solved the master problem to optimality in three 
seconds, we stop if the incumbent has z > z, or else we continue until we find such an 
incumbent or until the master problem is proven infeasible. 

Table 1 shows results for problems 1-4. Overall, Algorithm 3 has the best 
running times and can be 40 times faster than solving [MXSP-D] directly by branch and 
bound. Algorithm 2 is fastest for smaller instances (but without upper bound 
information during execution). Algorithm 1 is the slowest of the four procedures. We 
would like to emphasize a few points; 

(a) Varying arc attributes while holding the network topology and algorithm fixed 
can lead to Avidely varying solution times: Compare means and standard 
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deviations for the running times. In the larger networks, the fastest run (among 
the 10 different runs) may be 100 times faster than the slowest. We are still 
investigating ways to reduce the running times of the longer-rurming problems. 





[MXSP-D] 


Algorithm 1 


Algorithm 2E 


Algorithm 3 


Problem 


ro 


To 


So 


T, 


S] 


N, 


Pi 


T2 


S2 


N2 


P2 


Ts 


S3 


Ns 


P 3 


1 


20 


107 


77 


110 


115 


51 


102 


2 


1 


21 


320 


2 


1 


20 


315 


2 


30 


978 


1215 


(6) 


- 


- 


- 


25 


18 


36 


690 


33 


36 


36 


630 


3 


40 


(7) 


- 


- 


- 


- 


- 


650 


560 


57 


1205 


220 


185 


51 


1220 


4 


50 


- 


- 


- 


- 


- 


- 


(5) 


- 


- 


- 


(7) 


- 


- 


- 



Table 2.1: Computational results foranetwork with 100=10x10 inner nodes (o=396),/?=100%, c=10, <^=10 
and r=5. The numbers in parentheses represent the number of problems solved to optiinality, out of 10 
cases, within 3600 CPU seconds. 

Legend: T* -Run time in CPU seconds for Algorithm h. 

(0 = branch-and-bound on [MXSP-D], 2=2E) 

Sh - Standard deviation in CPU seconds of Tj 
N* - Number of iterations for Algorithm h. 

Pfc - Number of constraints in the master problem when the algorithm h terminates. 



(b) All the algorithms are very sensitive to ro, the total available interdiction resource. 
Running time typically increases rapidly as ro increases from a small value but 
then starts decreasing for sufficiently large values, beyond those displayed here. 
(Variations in run times occur with changes in other data, but the basic trend 
remains.) This makes sense since increasing interdiction resource allows more 
combinations of arcs to be interdicted, up to a point, but then for sufficiently large 
ro, all or nearly all arcs can be interdicted, and the problem becomes relatively 
easy. 
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(c) In all problem instances, all of the algorithms find good solutions quickly: Most 
of the running time is spent proving, or trying to prove, optimality. 

(d) Table 2.2 displays results from runs designed to explore the sensitivity of the 
algorithms to network shape. The decomposition algorithms prefer “tall 
networks,” like the 12x8 network, over “long networks” like the 7x14 network. 
This tendency may result from the greater number of paths in a long network, the 
potentially greater number of constraints in the corresponding master problems, 
and because there is a positive correlation between the number of potential 
constraints and the actual number needed to generate a tight master problem. 
However, when not all of the arcs are interdictable (problems 8 and 9), the 
decomposition algorithms handle long networks quite well (perhaps because there 
are fewer potential constraints in the master problem). Branch-and-bound for 
[MXSP-D] seems to perform better on long networks. 





[MXSP-D] 


Algorithm 2E 


Algorithm 3 


Problem 




a 
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To 


So 


T2 


S2 


N2 


P: 


T3 


Ss 


N3 


P 3 


5 


12x8 
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100% 
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1 


1 


18 
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1 


1 


18 


240 


6 


8x12 


382 


100% 


350 


375 
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45 


1075 
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70 


43 


1125 


7 


7x14 


405 


100% 
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210 


(8) 


- 


- 




(8) 


- 


- 


- 


8 


10x20 


876 


50% 


98 


135 


30 


51 


40 


495 


58 


83 


38 


535 


9 


O 

X 

o 


1796 


25% 


85 


140 


20 


24 


55 


400 


62 


90 


52 


480 



Table 2.2: Computational results for networks with different network shapes, with ro=25, c=10, d=\0 
and r=5. The total number of potentially interdictable arcs is a and the percentage of interdictable arcs 
from a is p. See Table 1 for other definitions. 
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It may be possible to improve computation times substantially by settling for a 
slightly less-than-optimal solution. So, we next repeat the tests on particularly difficult 
problems, problems 3, 4 and 7, but allow a 5% optimality gap. Results are displayed in 
Table 2.3. (Optimality gaps were described previously in absolute terms. Here, an 
allowable gap of g% means 100(J-z)/z < g.) Indeed, run times can be significantly 
shortened. 





[MXSP-D] 


Algorithm 2E 


Algorithm 3 


Problem 


To So 


T2 S2 N2 ?2 


Tj S3 N3 P3 


3 


850 810 


233 183 43 1070 


114 77 40 1075 


4 


(7) - 


(7) - - - 


960 815 56 1620 


7 


48 37 


(9) - - - 


112 127 41 1770 



Table 2.3; Computational tests on problems from Tables 1 and 2 with a 5% optimality gap allowed. See 
Table I’s legend for definitions. 

In Table 2.4 we compare the algorithms for the case in which an interdicted arc is 
actually removed from the network. We fix the cost of interdiction to one unit of 
resource per arc, so we are actually solving the /r-most- vital-arcs problem for /f=5 and 
k=\0 in 7x7, 10x10 and 14x14 networks. Note that for standard branch and bound 
solving [MXSP-D] and for Algorithm 1, we use artificial delays of d=S and d=\Q. 
However, d=5 is often too small and yields incorrect solutions while d=\Q results in long 
run times. Branch and bound is the slowest algorithm on these problems, and Algorithm 
2 is the fastest by a substantial margin. Results for Algorithm 3 are omitted since that 
algorithm is slower than Algorithm 2. (We can view Algorithm 3 as Algorithm 2 with 
Benders cuts added in the master problem. But, these cuts are weak for large d, do not 
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add much information to Algorithm 2’s master problem and mostly serve to hinder 
solutions.) The table demonstrates the sensitivity of run times to network size and k. 
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860 


103.7 
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1353.0 


14.6 
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Table 2.4: Results for the fc-most-vital-arcs problems. Numbers in parentheses are the number of problems 
solved, in 10 trials, within 3600 CPU seconds (each). In the columns imder d=5, numbers in brackets are 
the number of problem solved correctly, out of the 10 trials. Numbers not in parentheses or brackets in the 
“algorithm columns” are CPU seconds averaged over 10 trials. 

Legend: k - Number of arcs the interdictor may interdict 
(Every arc is potentially interdictable.) 
d - Artificial delay. (Other data as in Tables 1-3.) 



F. CONCLUSIONS 

This chapter has discussed a shortest-path network-interdiction problem, MXSP, 
on a directed network. The objective of “the interdictor” is to attack (interdict) network 
arcs, using limited resources, so as to maximize the length of a shortest path between two 
specified nodes. Interdiction of an arc increases its effective length, or destroys the arc 
making it impassable. The ultimate purpose of the interdiction is to slow the movement 
of the “network user” through a road or other transportation network. 
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MXSP is an NP-complete, max-min problem. We show how to formulate the 
problem as a mixed-integer program (MEP) but develop decomposition techniques that 
typically solve test problems much more efficiently than does LP-based branch and 
bound with the MEP. Our first technique applies Benders decomposition with a standard 
master problem and shortest-path sub-problems, but the second decomposition uses a 
unique set-covering master problem. A third decomposition algorithm is a hybrid of the 
first two. Special techniques, including integrality cuts for the master problem and local 
search to generate more than one Benders cut per iteration, significantly improve 
efficiency over naive implementations of the decompositions. Numerous avenues are 
open for further research. These are discussed in Chapter VI, Conclusions. 

It is clear that our techniques may be generalized to “system interdiction 
problems,” as we shall demonstrate in next chapter. Later, we use these generalizations 
to solve a “system-defense problem,” in particular, the problem of hardening a road 
network against attack; see Chapter IV. The issue of uncertainty in interdiction success 
for MXSP is discussed in Chapter V. 
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m. THE SYSTEM-INTERDICTION PROBLEM 



The mathematical study of interdiction has, until now, focused on “network 
interdiction” in which an enemy’s supply lines, modeled as a network, are efficiently 
disrupted by attacking network components, e.g., bridges, roads, rail lines, etc. The 
purpose of this chapter is to generalize the network-interdiction techniques of Chapter II 
to handle the interdiction of general systems, for instance, a segment of an economy that 
is producing war materiel. 

Our basic system-interdiction model assumes that the interdictor makes resource- 
constrained, binary interdiction decisions to attack a system whose optimal operation is 
modeled through a mixed-integer linear program. We suggest solving this model using 
extensions of the three decomposition algorithms developed in Chapter H. We then 
extend those three decomposition algorithms even further, to solve a more general 
system-interdiction problem, where the optimal system operation is modeled through an 
even more general optimization problem. 

A. WHEN SYSTEM OPERATION CAN BE MODELED WITH A MIXED 

INTEGER (LINEAR) PROGRAM 

In this section, we assume that the optimal solution of the follower’s system can 
be adequately modeled through the optimization of an MIP. Let U = diag(u). Then, the 
Mixed-Integer Linear System-Interdiction Problem (MILSIP) is defined to be the 
following leader’s problem: 
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[MILSIP] 

[M-Sub(x)-1] 



z* = min ^(x) where^ (x) is defined by 

xeX 

fi(x)= max c^y 
yey(x) 



and X 



= {xs{OJ}" 




y(x) = {y I < b, 0 < y < C7(l - x),y € 7^^}, 



where c, y, ue5R”, c,betR'”, and Yjj^ represents integer (or binary) 

restrictions on none, some or all of the variables y. With the exception of the set Yint, 

formulation [MILSIP] is equivalent to formulation [LSIP], described in Chapter I. 
Thus, Xj = 1 means that activity j is interdicted, and that changes the upper bound on yj 
from Uj to 0. For notational simplicity, this model assumes that every activity is 
potentially interdictable but, in practice, certain activities will be off-limits, inaccessible 
or otherwise unavailable for interdiction. A more significant assumption for modeling 
purposes is: 

Assumption 3.1: The set Xis not empty and the inner maximization is feasible for every 
interdiction plan x. ■ 

One can imagine more complicated problems where the interdictor’s actions 
affect more than one activity at a time, or where those actions change the costs of the 
follower’s activities or his available resources. The following proposition shows that 
[MILSIP] can be modified to handle such situations. 
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Proposition 3.1; Let 



[MILSIP-1] 



min max c^y - x^Vy 
xeX yey(x) 



where 



X 




Rx<r 




y(x) = {y s9?^|iy<b-^,0<y,y s5} 



where By > 0 Vi,j . Then, [MELSEP-l] can be transformed into formulation [MILSIP]. 
Proof: See Appendix B. ■ 

Remark; The restriction >0 is acceptable, because we don’t expect that an 

interdiction would relax any of the system’s constraints. 

We would like to solve [MILSIP] with Algorithm 1, the Benders decomposition, 
but in order to do so we need to reformulate the problem. In Benders decomposition the 
feasible region of the subproblem is fixed, independent of the first level variables (x in 
our case,) while the objective function changes at every iteration. To obtain this situation 
in our case, we force the interdiction through a penalty term in the objective function, 
which will ensure that the use of an interdicted activity is not cost-effective. Then, we 
can leave interdicted activities free in the subproblem (their upper bounds are not affected 
by x), knowing for sure that these activities will not be used in an optimal solution. In 
some problems like the max-flow network-interdiction problem, however, an “exact 
penalty” of 1 allows an interdicted activity to be used without compromising equivalence 
of the models, at least in terms of x (Cormican et al. 1997). The following proposition 
gives us a more general result; 
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Proposition 3.2; When Assumption 3.1 holds, there exists v* < oo such that, for every v > 
V*, formulation [MILSIP] and the following problem, with V = diag(vl), have the same 
set of optimal solutions in x and y: 



[MILSIP -2] 


z** = min 

xeX 


fiOi) 


where f^ix) is defined by 


[M-Sub(x)-2] 


/ 2 (x) = max 
yeY 


c^y-x^Vy 






and X 


= {xe{04}" 


Rx<r], 




Y 


VI 

II 


0 < y < I/, y e 



Proof: First we show that for any x eX there exists v(x) such that for every v > v(x), 
^(x) = fiix), and arg max^ (x) = arg max^(x) . To do so, it suffices to show that 

yey(x) yeY 

(a) Every optimal solution of [M-Sub(x)-1] is feasible to [M-Sub(x)-2] with equal 
objective function value — ^that is trivial — and, 

(b) Every optimal solution of [M-Sub(x)-2] is feasible to [M-Sub(x)-1] with equal 
objective function value. To show that we, need to find v(x) such that for every v 

> v(x) every optimal solution y of [M-Sub(x)-2] satisfies x^Vy = x^y = 0 . 

To show (b), define = min[x^y| y sF, x^y>o|, = max c^y - yj (x) 

L J ygy 

(note that ^(x) is clearly bounded) and finally = \ + M^/5^ . Then, if the optimal y 

* T T 

IS such that x y >0, _^(x)<maxc y-<^x^x which is a contradiction because, by 

yer 

definition, max c y - <5^ Vx < (^) know that f{x)<f 2 (x) . 

yeY 
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The number of feasible solutions xeX is finite. So, let v* = max {v(x) |x e X). ■ 

X 

Corollary 3.1: MILSIP has an optimal solution where the follower’s part of the solution 
is a vertex of T= {y|^y>b, 0<y<u, ye INTy). ■ 

Remark: Proposition 3.2 is a variation on Morton and Wood (1999). It is shown there 
that ji(x) = ^(x) for all xgX, when y is continuous, ^^is an upper bound on the 

optimal dual multiplier for the constraint y/j < Uj(l-Xj) in [M-sub(x)-l] taken over ail 

X eX and V= diag(7t). (Note that computing the best possible bound may require full 
enumeration of the system value for every possible interdiction plan.) This approach 
does not work when we allow discrete variables y. 

Let V = diag(v*l). Based on Proposition 3.2 and Corollary 3.1, we can use 
Algorithm 1, the Benders decomposition, with formulation [MILSIP-2]. Define; 

[Master (iO] min z 

xeX,z 

s.t. z^c^y-x^Vy VyeT 

and apply Algorithm 1 using this master problem and the subproblem [M-Sub(x)-2]. 
Furthermore, it is clear that the integrality cuts of Chapter II are valid here, too, and can 

tighten the relaxation of [Master(iO] (see Proposition 2.1 and Corollary 2.1). 
(Straightforward adjustments are required since MXSP is a max-min interdiction 
problem, while the development in this chapter is for min-max system interdiction.) 
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As discussed in Chapter II with respect to MXSP, the subproblem of Algorithm 
1 finds an optimal reaction of the follower to a specific interdiction plan, which is 
feasible to the leader. Hence, ^(x) gives a lower bound on the leader’s optimal solution 
value. The master problem includes only a subset of the follower’s vertices and hence it 
yields an upper bound for the leader. Moreover, the feasible region of the subproblems is 
fixed, with a finite number of vertices, and in every iteration of the subproblem, there is a 
solution that is a different vertex of Y. Thus, the algorithm must converge. 

We can sometimes refine the penalty term to tighten the master problem. For 
instance, the penalty for different activities may be different. Such a modification is 
essentially what we have in MXSP, where the penalty matrix V =D represents the local 
delays on each arc. Moreover, given an interdiction plan x, the penalty multipliers 
v^ (y) for each activity j, can be functions of the optimal solution of the subproblem 

y = y(x) , as long as the cut we add to the master problem, z ^ > is 

j j 

valid for all x e X . (But, V cannot be a function of x since the constraints in the master 
problem would then be nonlinear.) 

Fcould also have non-zero, off-diagonal entries representing second-order effects. 
For instance, suppose that the two components of the system under study act “serially” so 
that destroying either one is as good as destroying both, i.e., yi=y 2 - If that Benders cut 



z<c^y + [xx X2] 

is valid, then so is the tighter cut 



"v 0 
0 V 
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z<c^y + [xi X2] 



V -,5v 
-.5v V 



Unfortunately, Proposition 3.2 and the discussion afterward do not suggest a 
general technique to determine a valid and effective penalty matrix V. Sometimes the 
structure of the system suggests one, as in MXSP with finite delays, but that is a special 
case. Recall Example 2.1, where we show the difficulties that an insufficiently large 
penalty might cause. On the other hand, the running time of Algorithm 1 can be 
excessive if we use a large penalty (compare results for d= 5 and d = 10 in Table 3.4). 
Therefore, we wish to devise an algorithm for MILSIP, similar to Algorithm 2E, that 
does not assume any bound on the local effect of an interdiction. 

Following the arguments upon which Algorithm 2 is based, we assume large 

penalty multipliers and wish to solve [Master(y)] for the first feasible solution with 
objective value greater the current lower bound. This is accomplished by solving the 
following set-covering problem (SCP): 

[Master(10-1] Find xeX 

s.t. i(y)^x >1 V y € y 

where Ij (y) = 1 if y^- > 0 and Ij (y) = 0 if yy = 0 . We can do so because every x 

feasible in [Master(y)-1] interdicts one of the basic (and positive) variables in every 
vertex in y, so x must be feasible in [Master(y)] and the leader’s objective there 

exceeds the lower bound, for v sufficiently large. In [Master(y)-1], the interdictor tries 
to interdict all the vertices thus far exposed by the follower, so “vertices” take the place 
of “paths” in the discussion of Algorithm 2 in Chapter II. 
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Analogs of the various enhancements we have suggested for solving MXSP with 
Algorithm 2 are applicable to solving MILSIP, too. To begin with, a local-search 
procedure can be used to generate more than one vertex of the follower’s feasible region 
per iteration. For instance: 

(a) If a linear program represents the follower’s system, we can use the last simplex 
tableau to reach some or all of the neighboring extreme points to the optimal 
solution. (Reaching all neighboring extreme points could require too much work, 
but a fixed computational budget could be allocated for finding some subset of 
these points.) 

(b) If MIP represents the follower’s system and [M-Sub(x)-1] is solved by branch and 
bound, feasible solutions found during the enumeration could be used in place of 
a local-search procedure. 

Procedure Lift in Algorithm 2 is based on the penalties used in Algorithm 1, 

and it must be modified to accompany the flexibility in the penalty matrix for the more 
general case. (If v is “very large,” it is likely that Lift will have no effect.) Similarly, 
procedure Compare should be modified if the penalty matrix has non-zero off-diagonal 
elements. However, when we use the same diagonal penalty matrix V for all the 
solutions of the subproblem, procedures Compare and Lift remain as they were in 
MXSP. 

Lastly, we can solve MILSIP with a hybrid decomposition algorithm, just as we 
use Algorithm 3 for MXSP. 
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B. INTERDICTION OF EVEN MORE GENERAL SYSTEMS 



We now generalize our results for interdiction of general systems, where optimal 
solution of the follower’s system can be adequately modeled through an arbitrary 
optimization model. Thus, the General System Interdiction Problem (GSIP) is defined to 
be the following leader’s problem: 

[GSIP] z* = nun /(x) where /(x) is defined by 

xeX 

[G-Sub(x)] /(x)= max ^(x,y) 

yey(x) 

and let y(i) = argmax g(i,y). (We assume that y(x) is non-empty, g(x,y) is bounded 
yey(x) 

over y(x) for all x € X and the argmax is always unique.) 

For constructing a Benders-type decomposition for solving GSIP, essentially 
Algorithm 1, we reformulate the problem as follows: 

Proposition 3.3: Assume that for every x €.X, we can find a scalar c{x)cmd vector of 
penalty multipliers v(x) that sati^ 

/(i) = c(i)-v(x)^i [3.3.1], and 

/(x) > c(i)-v(i)^x Vx€X. [3.3.2], 

Then, z* = z** where z* is defined by [GSIP], and z** is defined by 
[GSIP - 1] ^ = min z 

s.t. z > c(x) - v(x)^x V X e X. 

Furthermore, [GSIP] and [GSEP-1] share the same set of optimal solutions in x. 

Proof: From formulation [GSIP-1], z** = min z(x) where z(x) = max {c(i) - v(x)^x} , 

xeX ieX 

and conditions [3.3.1] and [3.3.2] ensure that z(x) = /(x) for all x eX. ■ 
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Corollary 3.2: For every x eX such that v(x)^x = 0, c(i) = /(i) is necessary to 
satisfy condition [3.3.1] . ■ 

A straightforward implementation of Benders decomposition to formulation 
[GSIP-1] defines: 

[Master(X)l min z 

s.t. r>c(i)-v(i)^x VieX, 

where X is a subset of the set of feasible interdiction plans. (We usually associate each 
constraint with a solution of the subproblem, but this representation is equivalent.) Given 
an interdiction plan x suggested by the master problem, the subproblem should find a 
scalar c(x) and vector of penalties v(x) such that conditions [3.3. 1-2] hold. Assume that 
we have such a subproblem, denote it by [G-Sub(x)]; Then, we have established 
Algorithm 1 for [GSIP]. Note that X is discrete and bounded, and therefore finite, so 
convergence is guaranteed. 

From Corollary 3.2, in order to validate conditions [3.3. 1-2] we need to solve [G- 
Sub(x)] exactly so that we know /(x) exactly. However, sometimes a sub-optimal 
solution of [G-Sub(x)] is sufficient: 
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Proposition 3.4: Assume that for any x eX such that /(x) > z *, the scalar c(x)and the 
vector of penalties v(x) satisfy 

z* < c(x)-v(x)^x [333], and 

/(x) > c(x)-v(x)^x VxgX [33.4]. 

(The multipliers need not satisfy conditions [3.3. 1-2].^ And, for any x eX such that 
/(x) = z*, c{x)and \(x) satisfy conditions [3.3. 1-2]. Then, z* = Z** (where z is 
defined by [GSIP] and z** is defined by [GSIP-1].) ■ 

Proof. Condition [3.3.3] ensures that z(x) > z * for any x e X such that /(x) > z *, and 
for any x eX such that /(x) = z *, conditions [3.3.1] and [3.3.2] ensure that z(x) = z * . 
Thus, z * * = minz(x) = z*. 

We now describe a possible use for the last proposition. Assume that during the 
solution process of [G-Sub(x)] we know that x cannot be optimal, i.e., we find y such 
that g(x,y) > z . Then, by Proposition 3.4, verifying that conditions [3. 3. 3-4] hold with 
respect to x is sufficient to guarantee convergence. See an implementation of this idea 
in Chapter IV, in Procedure Cutoff. 

Now that we have established the basics of Algorithm 1 for [GSEP], we can 
modify, extend and irn prove the techniques as we did for MXSP and MBLSIP; 

(a) Add all the enhancements discussed with regard to Algorithm 1, including the 
integrality cuts, 

(b) Derive Algorithm 2 and 2E (when the different enhancements are practical), and, 

(c) Finally, derive Algorithm 3 for [GSIP], 
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We would like to point out that the existence of scalars and penalty multipliers 
that satisfy conditions [3.3. 1-2] does not require that the function /(x) be convex, or 
anything else, when the set X includes only binary variables. This is so because we are 
interested in the value of /(x) only at certain of the comer points of the w-dimensional 
hypercube, and over these points it is possible to support any kind of function with a 
linear cut. (For instance, if we know that z* ^ 0 we can always set c(x) = /(x) and for 
every k, let Vjt(x) = /(x). The corresponding cut we add to the master problem, 

z^c(x)-^XjVj(x)yj , would be valid, but useless.) However, it is usually easier to 
J 

find relatively good penalty multipliers when the function /(x) is convex for continuous 
X, using gradient or sub-gradient information. 

In general. Proposition 3.3 and Proposition 3.4 do not provide a method to 
derive the necessary penalty multipliers for Benders cuts (although the constant c(x) can 
always be found by solving [G-Sub (x) ]). However,, we exploit those propositions in the 
next two chapters to validate penalty multipliers that we can create based on the special 
stmcture of certain system-defense problems. 

C. CONCLUSIONS 

In this chapter we have shown that the techniques used to solve the shortest-path 
network-interdiction problem can be used for solving interdiction problems concerned 
with more complicated systems. Sufficient conditions are given to establish a Benders- 
type decomposition algorithm for solving a general system-interdiction problem, too. 
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The construction of a useful decomposition algorithm for solving a system- 
interdiction problem depends on the specific structure of the interdicted system. As 
shown in this chapter, the helpful enhancements for solving MXSP we saw in Chapter II 
may be applicable to other interdiction problems, as well. 

In the next two chapters we use this chapter’s results to construct algorithms for a 
system-defense problem and a stochastic system-interdiction problem. Both cases are 
based on MXSP, but just as we have shown in this chapter, the results there can be 
applied to more general system-defense and stochastic system-interdiction problems. 



- 57 - 



IV. SYSTEM DEFENSE - THE SHORTEST-PATH NETWORK 



DEFENSE PROBLEM 



When a system user expects his system to be interdicted, he may be able to 
expend resources to protect that system to mitigate against the effects of interdiction. In 
this section we are interested in the following question: How should a system user 

employ limited resources to “harden” the components of his system to best protect 
against interdiction, given that the interdictor will optimize his interdiction with 
knowledge of those improvements? To answer to this question, we formulate and discuss 
the general system-defense problem (SD) and suggest extensions of Algorithm 1-3 as 
solution procedures. 

In the United States, the importance of system defense has been underscored by 
establishment of the President’s Commission on Critical Infrastructure Protection 
(PCCIP). The executive order that creates the PCCIP (The White House 1996) states; 

“Certain national infrastructures are so vital that their incapacity 
or destruction would have a debilitating impact on the defense or 
economic security of the United States. These critical infrastructures 
include telecommunications, electrical power systems, gas and oil storage 
and transportation, banking and finance, transportation, water supply 
systems, ....” 

The goal of PCCIP is to develop a strategy for protecting those systems against both 
physical and electronic attacks. The models we propose are most suitable for studying 
survivability of systems subject to physical attack. 



- 59 - 



Throughout the development of SD, we use the problem of Defending the 
Shortest Path (DSP) as an illustrative example. However, the results can be easily 
generalized to other and more general system defense problems. 

A. DEFENDING THE SHORTEST PATH - THE MODEL 

DSP is an extension to MXSP (see Chapter H), where before the leader attempts 
any interdictions, the network user may harden (protect) some of his arcs against a 
possible interdiction. The network user has a fixed budget for hardening arcs and any 
hardened arc is considered invulnerable to subsequent interdiction. So, in DSP, the 
network user first hardens certain arcs, the leader then interdicts some subset of 
“unhardened” arcs, and finally the network user traverses a post-interdiction shortest 
path. 

We assume that the network user has limited resources and that he catmot make 
his system completely invulnerable. Thus, the network user cannot completely protect 
any shortest s-t path. Let the set of feasible defense plans for the network user be given 

by G = {ge{0A}^'|^g<h}. We assume absolute protection so that git = 1 implies that 

arc k cannot be interdicted. DSP finds the optimal defense strategy for the network user, 
g*, and the value of the system, i.e., the length of the shortest path the network user is 
assured to have available for use. 

Notice that for every feasible defense plan g, the associated value of the system is 
given by a solution to an MXSP where the protected activities are invulnerable. And, 
recall that MXSP is NP-hard. Thus, we need to solve an NP-hard problem just to 
evaluate the objective function of a feasible solution to DSP. This fact leads to the 
following complexity result: 
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Proposition 4.1; DSP is NP-hard and not known to be in NP. ■ 



Formally, given a graph DSP is defined as the following problem for 



the system user: 



[DSP] Zn = min max min c^y 

geG xeX(g) yeY(x) 

where G = {g 6 {04}^' | Hg < h}, 

^(g) = |x e{0,l}^l I /?x < r,0 < X < l-g|, and 



Y(x) 



iy 



y is an incidence vector for an 5 - r 
path that is feasible with respect to x 



Note that DSP is a min-max-min instance of the Linear System-Defense Problem 
(LSDP), which we defined in Chapter I (since 7(x) can be represented by a set of linear 
flow-balance constraints and non-negativity restrictions). For modeling purposes we have 
the following assumption; 



Assumption 4.1: The sets G, Jf(g) for all geGand F(x) for all x 



{x e{0,l}^^l |/?x<r,0<x<l} 



are not empty. 



DSP can be viewed as a min-max system-interdiction problem where the network 
user is the leader and the interdictor is the follower. In DSP, the network user, now 
called the “defender,” minimizes the effectiveness of the interdictor’s best possible 
interdiction plan by choosing a defense plan that prevents, or “interdicts,” some of the 
interdictor’s possible activities. This observation suggests solving DSP through a nested 
decomposition algorithm. In particular, the master problem for DSP uses one of 
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Algorithms 1, 2 or 3, except that the variables correspond to defense plans, rather than 
interdiction plans, and each subproblem solves an instance of MXSP by applying one of 
those algorithms. 

B. NESTED DECOMPOSITION FOR SOLVING DSP 

Let 2 (g) be the length of the shortest-path the network user guarantees by 

defending with plan g. Then, the network user’s problem is equivalent to min z(g) . 

gsG 

By Proposition 3.3, to apply Algorithm 1 to DSP, it suffices to have for any 
given defense plan g a constant c(g) and a vector of penalties V£> such that; 

(a) z(g) > c(g) - g^V^x(g) V g e G, and 

(b) z(g) = c(g) - g^V^x(g), 

where Vd = diag(v£)), and x(g) is the optimal response of the interdictor to g . 

Since g^Vpx(g) = 0 for all geG (the interdictor cannot interdict a protected 
arc), based on Corollary 3.2 we must set c(g) = z(g) = c^y(x(g)) , where y(x(g)) 
denotes the shortest-path response of the network user given x(g) . Thus, we can 
calculate c(g) by solving the MXSP associated with defense plan g . (For simplicity, we 
assume that y(x(g)) and x(g) are unique, but all results in this chapter can easily be 
generalized to allow multiple optimal responses.) 

Assuming the existence of a valid penalty vector v^, we can solve DSP through 
Nested Algorithm 1 (denoted by NA-1) where the master problem and subproblem are; 

[D-Master(^] Zx= min z 

^ geG 

s.t. z > c^y(x(g)) - g^Vz)X(g) V g e G 
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[D - Sub(g)] Zi = max min 
^ xeX(|) yer(x) 

where 



T 

c y 



X(g) ={xe{04}^' 

r(x) = 



Rk 



< r, 0 < X < 1 - g}, 



and 



y is an incidence vector for an 5 - r 
path that is feasible with respect to x 



where G is a subset of all the possible defense plans. 

At every iteration of the decomposition algorithm, the master problem suggests a 
new defense plan g and update Zj ) , and the subproblem solves the system-interdiction 



problem associated with g , adds the solution to G, and updates zd , if appropriate. (The 
subproblem is simply an MXSP which is solved with Algorithm 1, or 2 or 3.) If the 
solution of the master problem or the subproblem is ever repeated, we must have 
ZD - Zj) and the algorithm has converged. Therefore, the algorithm is theoretically 

guaranteed to converge, if the number of possible interdiction plans or defense plans is 
finite. 

The remaining question is, of course, how to determine a valid penalty vector v £> . 
We will answer this question for DSP, as well for the more general LSDP, under the 
following assumption. 



Assumption 4.2; The feasible set of interdiction plans, X, is “closed” in the sense that 
any interdiction plan that is a part of a feasible interdiction plan is feasible too. 

This assumption is reasonable if interdictions consume non-negative quantities of 
resource and do not generate additional resource. 
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Proposition 4.2: Let Vj = 


= diag(v) be a valid penalty matrix for a linear system 



interdiction problem LSIP: 



[LSIP] Zi = min 

xeX 


max c^y 
yeytx) 


where 


X = |x e {0,1}” Rs. < rj, and 
Y(^) = {y 1 ^ b, 0 < y < 17(1 - x)}. 



i.e., (by Proposition 3.2) [LSIP] and [LSIP-1] have the same set of optimal solutions 
and the same objective function value, where: 



[LSEP-1] Zj = min 

xeX 


max c^y - x^Ky 
yeF 


where 


X = |x e {0,1}” Rx < r j, and 
y = {y |Ay <b, 0<y <!/)}. 



Also, let [LSDP] be the system-defense problem associated with [LSIP]; 



[LSDP] Zd = max min 

gsG x€X(g) 


max c^y 

yeF(x) 


where 


5 ={ge{ 04 }” i7g<h}, 

■^(g) = |x e { 04 }” ifcs < r, 0 < X < 1 - g|, and 
y(x) = {y 1 Ay < b, 0 < y < 17(1 - x)}. 



Then, when Assumption 4.2 holds, Vj^ = Vj is a valid penalty matrix for solving SD with 
algorithm NA-I. 

Proof: By Proposition 3.3 and Corollary 3.2, it is sufficient to show that for ail x eX 
and gsG, Z£,(g) = c^y < c^y(x) + where y = y(x(g)). Let Xg be the 

interdiction plan that interdicts an activity only if it is interdicted by interdiction plan x 
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and not protected by g. Assumption 4.1 and the construction ensure that Xg eX(g). 

Clearly, c y(Xg) > Z£>(g). Now, y(Xg) € y(x) and due the optimality of y(x) in the inner 
maximization in [LSIP-1] that is associated with x, we must have 
c^y(x) > c^y(Xg) - x^V/y(Xg) . Notice that (x^V/y(Xg))^. > 0 can happen only when 

y(Xg)jt > Oand X]^=l, but that implies gj^= Xj^=\. So, x^V/y(Xg) = g^l^y(Xg), and 
c^y(x) + g^V/y(Xg) > c^y(Xg) . This finishes the proof because c^y(Xg) > z^(g), and 
so c^y(x) + g^V/yCXg) > Z/>(g) , too. ■ 

Corollary 4.1: Proposition 4.2 holds even when some or all of the variables y 
(the system’s fundamental variables) are restricted to integer values, since nowhere in the 
proof of that proposition is y is required to be continuous. 

To better understand Proposition 4.2, consider its meaning in DSP. In this case, 
interdicting an arc k increases the length of the arc by dk, and hence cannot increase the 
length of the shortest path by more than dk. In the same sense, protecting this arc cannot 
decrease the shortest path by more than the difference between the original length of the 
arc and its length after interdiction, namely dk. Indeed, Proposition 4.2 proves that 
Vj) = D, where Z>=diag(d), will work. 

We now focus on [D - Sub(g)] in NA-1 for DSP. We might need to solve this 
problem many times and so it may be useful to have some kind of a “warm start,” that 
uses information from previous iterations. When solving [D-Sub(g)], the master 
problem is; 
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[Sub(g)-Master(y)] 



max 



z 






s.t. 



T' A T ^ 

z<c y+x Dy 



Vy sF 



Notice that all the cuts of the form z < c^y + x^Dy are valid independent of the defense 

A 

plan. Thus, as a warm start, we can begin a new iteration of the algorithm with the set Y 
from the end of the previous iteration. 

In NA-1 we also incorporate Procedure Cutoff. Recall that the smallest objective 
values from the subproblems (the inter dictor’s problem) solved so far is an upper bound 
on Zd, denoted by . In consecutive iterations, we can terminate solving a subproblem 
when, given g , the subproblem finds a sub-optimal solution x(g) e X(g) with optimal 
response y(x(g)) such that c^y(x(g)) > zd- This technique uses Proposition 3.4: Once 
we recognize that the current defense plan g is not optimal, the new cut generated from 
the subproblem need not be tight at g . Thus we stop solving the subproblem with a sub- 
optimal solution x(g) , add x(g) to X and solve again the master defense problem. 
Convergence is guaranteed because the new Benders cut, z > c^y(x(g))-g^B^(g) 
ensures that g can no longer be the optimal solution of the master defense problem. 
(Recall that the solution of the master defense problem z^ is a lower bound. If g were 
still optimal, we would have a contradiction since we cannot have 
z^> c^y(x(g)) - g^Wx(g) > ZD .) 

Nested Algorithm 2E, denoted by NA-2 and derived from Algorithm 2E, can be 
used to solve DSP (and other LSDPs) as well. In the highest level, the system user tries 
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to prevent interdiction plans suggested by the interdictor. For each new defense plan the 
interdictor solves the interdiction problem with Algorithm 2E. When the system user 
fails to prevent all the interdiction plans suggested so far by the interdictor, the algorithm 
terminates. The best defense plan the system user has tried until now is an optimal 
defense plan. The algorithm must converge if the number of possible interdiction plans 
or defense plans is finite. 

Recall that Algorithm 2E includes several special procedures, namely 
LocaI_Search, Compare and Lift. The concept of local search in DSP translates into 
the generation of more than one interdiction plan (to be covered by a defense plan) per 
iteration. Fortunately, when we solve each subproblem we are actually suggesting 
interdiction plans and evaluating their objective function values (shortest-path lengths 
given the interdiction). We can keep this information and every interdiction plan with 
objective value higher than Zj) (when the interdiction plan was exposed or after the 

lower bound was updated), can be introduced into the set of interdiction plans to be 
covered by any new defense plan. 

Procedures Compare and Lift, as described in Chapter II with respect to MXSP, 
apply to DSP with essentially no change. 

In NA-2 we incorporate Procedure Cutoff just as we do in NA-1. This procedure 
is helpful when we have a good heuristic for the interdictor’s problem, and we do have 
such a heuristic when the interdictor has a single resource constraint. In this case, we can 

solve the interdictor’s master problem as an SCP ([Master(y)-2c] in Chapter II), and we 
can run Algorithm 2E as a heuristic by solving that master problem using only the 
greedy SCP heuristic. 
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Last, as we suggested for NA-1, we can employ a warm start in NA-2 using 
information from previous iterations. This may speed the convergence of the inner 
Algorithm 2 used to solve the subproblem. Recall that at the end of Algorithm 2E we 

have two sets of s-t paths. Those sets are Y and Y* where T* is a set of “reserve 
paths.” We can merge these two sets and use them as a starting reserve set for the next 
iteration of the inner covering algorithm used to solve the subproblem. By doing this, we 
may require fewer iterations to generate a list of extreme points in Y that the interdictor 
cannot cover, and thus solve the subproblem using fewer iterations. 

Unfortunately, computational experience indicates that the effort involved with 
the warm start is not always worthwhile. In MXSP we are able to generate paths very 

quickly, but we drop dominated paths and lift others, so the actual set Y at the end of the 
algorithm is only a small subset of the paths that were generated during the course of the 
algorithm. Therefore, if we want to save all the original paths, extra work is needed; it 
may be simpler and faster to regenerate those paths in subsequent iterations. 

So far, we have discussed two nested decomposition algorithms for solving DSP, 
NA-1 and NA-2. In should be clear that we can also establish an analogous version of 
Algorithm 3, Nested Algorithm 3 (NA-3). Given the above discussion creating this 
algorithm is straightforward and we omit any further description. 
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C. COMPUTATIONAL EXPERIENCE 

To test the algorithms we have constructed, we use the same structure of the test 
problems of Chapter n. The only additional parameters are the total defense resource 
available /zo(we assume a single defense resource) and the defense resource needed to 

defend each arc k, namely which is integer and uniformly distributed on [1,/?]. 
Algorithm NA-1 is tested with procedures Warm_Start and Cutoff. Algorithm NA-2 is 
tested only with procedure Cutoff. We do not test NA-3 here because for the amount of 
interdiction resources examined, Algorithm 2E and Algorithm 3 give similar results (see 
Table 2.1). 

Table 4.1 shows the average results across 10 problems for 3 different 
combinations of defense and interdiction resources. For instance, in NA-2 problem set 
3D, the master defense problem includes 535 cuts on average, each one representing an 
interdiction plan. The algorithm generates those 535 interdiction plans while solving 
only 265 interdiction problems, because of the Local_Search procedure. Moreover, 
those 155 interdiction problems are solved in 440 CPU seconds, even though a single 
interdiction problem with 30 units of interdiction resources requires 25 seconds CPU on 
average (see Table 2.1 problem set 2.) The time improvement factor is almost 10, and is 
a result of procedure Cutoff. 
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Algorithm NA-1 


Algorithm NA-2 


Prob 




ro 




Si 


Nf 


n1 




S 2 








ID 


10 


20 


325 


60 


40 


140 


33 


17 


65 


1210 


155 


2D 


15 


20 


475 


175 


72 


180 


75 


70 


135 


1670 


305 


3D 


10 


30 


- 


- 


- 


- 


440 


265 


155 


3375 


535 



Table 4.1: Computational results for the shortest-path network defense problem, with 10x10 inner nodes 
(a=396), c=10, ^10, r=5 and h=5. 



Legend: . 

S,- 



Running time in CPU seconds for Algorithm NA-/. 

Standard deviation in CPU seconds of T)- . 

Number of iterations in the master defense problem in NA-/. 

Total number of iterations in the master problem of the sub- 
problem (the interdiction problem) in NA-/. 

Number of interdiction plans (i.e., cuts) in the master defense 
problem in NA-2. 



In NA-1 we can see the advantage of procedure Warm_Start, too. In NA-1 
problem set 2D, we solve 72 interdiction problems on average, with total of 180 master 
iterations in the interdiction problems. On the other hand, when we solve only one 
interdiction problem, we need 51 iterations on average (see Table 3.1). Thus, every new 
defense plan requires, on average, only 2 iterations in the interdiction problem, due to the 
Warm_Start and Cutoff procedures. Those 72 interdiction problems are solved in 475 
CPU seconds while a single interdiction problem requires 110 CPU seconds (see Table 
3.1). Therefore, the overall time improvement factor is more than 15. 
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D. CONCLUSIONS 



The system-defense problem that we first defined as a natural extension for the 
system-interdiction problem, turns out to be a system-interdiction problem in itself, 
where the defender interdicts the interdictor’s system. This observation let us solve the 
problem of defending the shortest path with nested decomposition algorithms. 
Fortunately: 

(a) We can use the fact that the defender interdicts a system-interdiction problem, to 
find valid penalty multipliers that are needed in Algorithm 1, 

(b) The enhancements included in Algorithm 2E are applicable here, too, and 

(c) Every subproblem solves a system-interdiction problem with a decomposition 
algorithm, but solving k subproblems doesn’t require k times the time that one 
problem requires, due to Warm_Start and Cutoff procedures we include in the 
nested decomposition. 
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V. STOCHASTIC SHORTEST-PATH NETWORK INTERDICTION 



Uncertainty may play a key role in some interdiction scenarios. For instance, the 
interdictor may have only limited intelligence on the system he attacks, and the success 
of interdiction attempts may be uncertain. Thus, the interdictor must determine his 
actions with incomplete information about the current state of the system and/or how the 
system will “react” after interdiction. We take an obvious approach to modeling 
stochastic situations: We assume that the interdictor has a measure for the expected value 
of the system after interdiction, and that he wishes to degrade this measure as much as 
possible. 

Throughout the chapter we focus on the max-min stochastic shortest-path 
network-interdiction problem, S-MXSP, where interdiction success is uncertain. We note 
that Cormican et al. (1998) have studied one stochastic network-interdiction problem, 
with a different objective than MXSP, where other network data may be uncertain, too. 
However, we assume that all network data are known exactly. We show how the results 
of Chapter HI can be used to establish decomposition algorithms for solving such 
stochastic network-interdiction problems, exactly or approximately. The approach can be 
used for solving other stochastic system-interdiction problems, too. 

A. THE MODEL 

The mathematical programming formulation of S-MXSP on a directed graph 
is: 
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[S-MXSP] 



maxE 

xeX 



where: 



min 2(Cifc ^XkSj,dk)yk 
U^^keA 



(a) s e{04}^ is a random vector: The outcome of the random variable S/^ is 

denoted by probability pk, and =0 with probability l-pk- Thus, 

0 < ^ 1 is the probability an interdiction attempt on arc k is successful. We 

assume that the successes of separate interdiction attempts are independent 
events. 

(b) The rest of the formulation is the same as in MXSP. Thus, 

X = {x - *■} represents the set of feasible interdiction plans and Y is 

the set of all s-t paths, represented in MXSP through flow balance constraints. 
For simplicity and without lost of generality we assume that for every k, 

(an infinite delay can be replaced by a very large, but finite, delay, which would 
ensure that no shortest path would use arc k when it is interdicted), and we assume 
that all arcs are interdictable (a non-interdictable arc k can be modeled by setting 
4=0), 



In S-MXSP, the inner minimization problem is a standard shortest-path problem 
with arc lengths Ck + Xk Sk dk. That is, the network user finds a shortest s-t path given the 

interdiction plan x and its random outcome x^Sk for every k. We denote this shortest 
path by y(x,s) where y/t(x,s) = l if the path y(x,s) uses arc k, else y^(x,s) = 0. For 
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simplicity, we assume y(x,s) is unique, but all results in this chapter can easily be 
generalized to allow multiple shortest paths. 



Let E n^^iCk+x^sMyk 



= E 



,keA 



= z(x) be the 



expected length of the shortest s-t path given interdiction plan x, so that S-MXSP is 
equivalent to maxz(x). z(x) can be calculated exactly by solving the shortest-path 

xeX 

problem associated with each outcome of the random vector s . The literature also offers 
several algorithms for estimating z(x) (e.g., Alexopoulos 1997, Fishman 1985). 

The basic model assumes that only a single interdiction may be attempted on any 
arc. The following discussion shows that this is not actually a restriction. Assume that 
we have an arc /r, which can be attacked by n different methods. Each method includes 
one or more independent and/or dependent interdiction attempts. For instance, arc k can 
be attacked by an airplane formation, 2 cruise missiles, or both, so we have three possible 

methods. Denote by pi the probability of successful interdiction when method of attack 



j is chosen, and by dl the delay expected on arc k when attack by method j is successful. 
To handle this situation we introduce the following construction: 

(a) We “break” the arc k into n serial arcs, k}~ ,...,k !* , each with length Cj^jn . 



(b) We set the probability of successful interdiction on arc k^ to be pi and the delay 
when the arc is interdicted successfully to dl . 

(c) Last, we add the constraint x,\ +x, 2 +...+x,„ <1 to make sure that only one 

method of attack is chosen (recall that a method of attack may include several 
interdiction attempts). 
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The constmction ensures that if none of the arcs is interdicted, or one of 

the arcs is interdicted but not successfully, the effective length of the composite arc k\ is 
nx(ci^/n) = C/^. But if method of attack j is chosen, and arc k-^ is interdicted 

successfully, the effective length of the composite arc is « x (Cj^/n) + dl, as required 

B. DECOMPOSITION APPROACH 

By Corollary 3.2, we can construct Algorithm 1 for solving S-MXSP if we have 
constants c(x) and penalty multipliers V;j.(^) such that: 

[5.1] z(x) = c(x) + ^Vj(.(x)i^ VxeX, and 

keA 

[5.2] z(x) < c(x) + 2^Vjt(x)x;t Vx,xeX 

keA 

Given the coefficients c(x) and v(x) , the master problem of Algorithm 1 is 

[Master(.^j max z 

s.t. z ^ c(x) + ^ V;(.(x)X;t for every x eX 
ksA 

where X is a subset of the set of feasible interdiction plans, and the subproblem, Sub (x) , 
provides c(x)and v(x)such that [5.1] and [5.2] hold. The following proposition shows 
how valid c(x) and v(x) can be calculated. 

Proposition 5.1: For every x ^X,dejine\ 

[5.3] c(x) = , and 

keA 

[5.4] v^(x) = 

Then, conditions [5-1] and [5-2'\ hold. 
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Proof; 



z(x) 



= E 



= E 



min +XkSkdk)yk 

Z(^A: +XkS^df,)%(x,s) 



.keA 



<E 



Z(^Jt +^jfc-yjfc4)J/fc(x,s) 



for all X e X 



.keA 

and equality must hold when x = x, because given x and s, y/^{x,s) is, by definition, 
the shortest path. Now, 



E 



+XkSkdk)yk(^^s) 

k^A 



keA keA 



= C(x)+ ■ 

keA 



Remarks: 

(a) c(x) is the average length of the shortest path that the network user traverses, 
excluding delays, given interdiction plan x . E[y^(x,s)] is the probability that the 

network user traverses arc k, given interdiction plan x . 

(b) If is the average delay the network user experiences on arc k, given 

interdiction plan x. is the probability that the network user 

traverses arc k given that the arc is successfully interdicted. 

(c) The proposition actually establishes that if x does not interdict arc k, v*(x) 
bounds the (average) gain the interdictor can achieve over z(x) by interdicting 
this arc. Notice that when Xi^=0, 
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= where E[;yjt(x,s)] is the probability that the network user 
traverses arc k given interdiction plan x. 

Proposition 5.1 enables solution of S-MXSP through Benders decomposition, 
i.e., through Algorithm 1, at least in theory. The master problem suggests an interdiction 
plan X , and the subproblem (/) evaluates z{ x ), which may update the lower bound, and 
(if) generates a new cut for the master problem through calculation of .E[yjt(x, s)] and 

£[ 5 j^yjt(x,s)]. To compute these expected values, the subproblem solves 2^** shortest 

path problems, one for each possible outcome of the interdiction plan x . 

In addition, we can use the Benders cut for building the integrality and covering 
cuts in the usual way (see Chapter HI), establishing versions of Algorithm 2E, the 
covering decomposition, and Algorithm 3, the hybrid algorithm, for solving S-MXSP. 
An important part of those two algorithms is a local-search procedure that can find more 
than one covering cut per iteration. We will discuss this in more detail later. 

A major difficulty of all three decomposition algorithms is the exponential 
complexity of the subproblem. For instance, if an interdiction plan interdicts 10 arcs, the 
subproblem requires solution of 1024 shortest-path problems, which our code does in less 
than 2 CPU seconds (for a 10 x 10 network). An average of 2 seconds CPU time for the 
subproblem is not a major concern. But, if the interdiction plan interdicts 20 arcs, the 
running time of the subproblem increases to over 2000 CPU seconds per iteration! Thus, 
the subproblem quickly becomes intractable. 
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C. APPROXIMATION THROUGH DECOMPOSITION 

In trying to cope with the complexity of the subproblem, we suggest a series of 
approximation algorithms which share the following principles; 

(a) There is no change in the master problem; either one of the three decomposition 
master problems may be used. But, to keep the discussion simple, we assume that 
the master problem of Algorithm 1 is used. 

(b) The subproblem solves a “reasonable number” of shortest-path problems. 

(c) Given an interdiction plan x , the subproblem for approximation h, sets values for 

c(x) = c^(x) and v^.(x) = v^(x) such that [5-2] holds, i.e., 

z(x) < c^(x) vjt(x)A;^ Vx,xeX. As a direct result, 

keA 

(x) = c^(x)+ ^ v^(x)x/^ is an upper bound for z(x). 
k eA 

(d) We add to the master problem for approximation k the valid inequality, or “slack 

cut,” z ^ c^(x) + (x)JCjfc. We call that a “slack cut” because [5-1] may 

keA 

not hold. However, since [5-2] holds, the value of the objective function of the 

master problem, denoted by z for approximation h, is a valid upper bound for 
the solution of S-MXSP. We may also add to the master problem the integrality 
cut associated with this slack cut. 

(e) For a given master problem, we define z* =maxz*(x). We use z* as an 

xeX 

artificial, possibly invalid, lower bound on zCx”^). 

h It 

(f) When the difference between z and z drops below a designated approximation 
gap, we say that “the approximation algorithm has converged.” 
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(g) The algorithm must converge because the number of feasible interdiction plans is 
finite, and in every iteration the master problem either suggests a new interdiction 

plan that is not yet in X , or z * = z* • 

(h) The procedure actually solves a problem with a modified objective z*(x). 

Denote by x the optimal (or nearly so) solution that approximation algorithm h 
achieves using the modified objective. 

(i) When practical, the algorithms establish a lower bound on the solution of S- 

If If If 

MXSP and a true optimality gap, z -z(x ), by calculating z(x ) using full 

enumeration. When this is impractical, the algorithms estimate z(x ) through 

sampling. (Any other algorithm that gives a lower bound on z(x ) could be used 
here, too.) 

0 Last, as an optional step, full enumeration of z(x ) can be used to tighten the cut 

h 

in the master problem associated with x , and the master problem can be re- 
solved. This may improve the upper bound. 

To establish an approximation algorithm as described above, we only require a 
subproblem that sets values for c* (x) and v* (x) such that [5-2] holds. Next, we 

introduce a proposition that helps us to derive such subproblems, but first we need some 
definitions. 
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h 

Definition 5.1: A deterministic reply strategy y (s) for the network user, is a function 
that assigns an s-t path y (s) , for all possible outcomes s e 5 . 

The deterministic reply strategy represents a possible way of action for the 
network user. Given outcome s, the reply strategy assumes that the network user 
traverses path y*(s), independently of the current interdiction plan. This is a feasible 
reply but the network user may have better choices. Therefore, for every interdiction plan 
X, the average shortest-path length achieved by y^(s) given x, is an upper bound on 
z(x) . We now define a more general set of feasible reply strategies. 

Definition 5.2: A randomized reply strategy y*(s) for the network user is a function that 

assigns a probability distribution ^(y [ s) , over the set of all s-t paths (denoted by y e 7 ), 

for all possible outcomes s e 5 . (Thus, ^ <f>{y |s) =1 for all s e 5. ) 

yey 



y*(s) also represents a possible way of action for the network user. Given 
outcome s , the randomized reply strategy assumes that the network user traverses path y 
with probability ^(y | s) , independently of the current interdiction plan. Note that any 

deterministic reply strategy can be defined as a randomized reply strategy, too. We now 
show formally how to devise a slack cut, and thus an approximation algorithm, from any 
reply strategy. 
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Proposition 5.2: Let y*(s) he a randomized reply strategy associated with 

approximation h. Define: 



[5.5] 



[5.6] 



c^(x) 



= Z^x(y|s)3'jfc » 

ksA 



and 



yeF 






Then, [5-2] holds, i.e., z(x) < (x) + ^ v* (x)^;^ V x, x € X. 

ksA 

Proof: For all x eX, 



z(x) = E 



= E 



min ^(Cjfc +Xi^Sj^d;i)yk 

y^^keA 



f 



min y 



(Ck+XkSkdk)^^i(y\s)yk 

y^Y 



<E 



( - - ^ 
Z + ^khdk ) Z (y I s )h 

yey 



y J 



llc,E 

keA 



Z<^x(y|s)y;fc 



+Xkd^E j*Z^x(y|s)y* 



yeF 






c (x)+Z^it(x)^jfc 

keA 



Corollary 5.1: We can establish an approximation algorithm by defining how a 
subproblem sets a reply strategy, deterministic or randomized, for any given interdiction 
plan X. ■ 
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Thus, in the approximation algorithms the subproblem takes in an interdiction 
plan X and returns a randomized reply strategy y*(s) or a deterministic reply strategy 

yj(s) . In the exact decomposition algorithm the subproblem does the same, but there it 

finds the best reply strategy (which is always deterministic), while in the approximation 
algorithm the subproblem finds a sub-optimal strategy. However, in order for the 
approximation algorithm to work effectively, it should find a relatively good reply 
strategy without too much computational effort. We next describe several approximation 
algorithms, each one characterized by its reply strategy. 

Algorithm HI 

The first approximation through decomposition uses a simple expected-value 
approach. Given interdiction plan x, let y^(x)be the shortest s-t path in the network 
using expected arc lengths, i.e., using arc lengths C), ->rx^.p^.dj^ . Now, for all interdiction 

plans X, define the deterministic reply strategy by yi(s) = y^(x) for all s€5. By 

Corollary 5.1 we have established an approximation algorithm. Algorithm HI. 

The modified objective in HI (see principle (h)) assumes that the follower knows 
the chosen interdiction plan and all success probabilities, but not the actual outcome of 
the executed interdiction plan. This “restricts the recourse” of the follower (see Morton 
and Wood 1999) so we obtain an upper bound on the solution for S-MXSP, as we already 
know, from Proposition 5.2. 
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In this approximation, every subproblem solves just one shortest-path problem. 
Actually, approximation algorithm HI is a decomposition for the deterministic 
interdiction problem with dk replaced by d^Pk = d^ESk ■ Therefore, we can apply the 
Algorithm 2E or Algorithm 3 with the LocaI_Search procedure established for the 
deterministic case. The running time of the approximation HI (without the evaluation of 
the exact objective function of the candidate solution; see principle (i) above) should be 
roughly the same as the running time for the deterministic interdiction algorithms. 

Algorithm H2 

As a refinement to HI, the modified objective of approximation H2 assumes that 
the follower knows the original interdiction plan, all success probabilities and also (and 
this is the difference between HI and H2) the number of successful interdictions. 
However, the follower does not know which specific arcs were interdicted successfully. 

Given an interdiction plan x , let n be the number of interdiction attempts. For m 

= 0,...,n, />^”*^(x) is the probability that x results in m successful interdictions. Let 
d]^ = E\skdk |w,x]. Hence, Ck +Xkdk is the expected length of arc k given x and m. 
Let y^’'”(x)be the shortest s-t path in the network with these arc lengths. Now, for all 
interdiction plans x, define the deterministic reply strategy by y^(s) = for 

all s where m(s,x) if the number of successful interdictions x causes given outcome 
s . By Corollary 5.1 we have established an approximation algorithm H2. 
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In this approximation, every subproblem solves just n shortest-path problems. 
(Notice that y^’°(x) is the shortest s-t path with no interdiction, which is independent of 
X.) However, we need to calculate p^'"\x) and . When p^= p for every k e A, 
p^'"\x) can be calculated directly from the binomial distribution, and the fact that 

= — d/^. When different arcs may have different probabilities pk, these parameters 

can be calculated in 0(\A\^) time using the generating function 
/«)= Y\iPti+(^-Pk))- 

keA 

Approximation H2 partitions the probability space according to the total number 
of successful interdiction attempts. Other partitioning schemes may be used too. For 
instance, a partition can be based on the success of a single interdiction, or on the number 
of successes in a group of arcs, etc. Furthermore, an algorithm can start with a crude 
partition and refine it later, until it reaches a desired optimality gap. This procedure is 
called “sequential approximation” in the stochastic programming literature (e.g. Kail et al 
1988) and it was used by Cormican et al. (1998) for solving a stochastic max-flow 
network-interdiction problem. Algorithm H3 uses yet another partitioning scheme. 

Algorithm H3 

In this algorithm, the subproblem solves the shortest-path problem for a relatively 
few, “most likely” outcomes, and bounds the shortest-path length at all other possible 
outcomes, using the simple expected-value approach. Assume for instance that x 
interdicts 10 arcs and the probability of success is 0.8 for every arc. Instead of solving 
1024 shortest-path problems (as the exact decomposition algorithm would do), an 
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approximation algorithm H3 of “enumeration depth” 2 solves only the cases where 8 
(8 = 10-2) or more of the arcs are successfully interdicted. There are only 56 such 
outcomes but they cover about 68% of the probability space. Then, the approximation 
bounds the shortest-path length in the remaining 968 outcomes by finding one shortest- 
path which is optimal with respect to the average delays across those outcomes. 

To establish approximation H3 of enumeration depth 2 formally, define the 
following sets: 

(a) S' is the set of all outcomes s with 2 or fewer failures in x , and 

(b) S" is the set of all outcomes s with more than 2 failures in x. 

Now, for all interdiction plans x, define the deterministic reply strategy by 

y^(s) = y(x,s) for all s g S' , and by y*(s) = y^(x) for all s gS" , where y^(x) is the 
shortest path with arcs lengths defined as E\c^ + e 5"] for all k ^A. 

Example 5.1 

This example demonstrates the way subproblems work in the exact decomposition 
algorithm and in the three approximations suggested so far. Moreover, we later use this 
example to motivate a possible improvement to approximation H3. 

Assume that the interdictor interdicts 4 arcs, denoted by ^1, A2, ki, and M. There 

are 2^ = 16 possible outcomes and each is denoted by a four-digit binary number. For 
instance, 1010 represents an outcome in which the interdiction of k\ and k3 are 
successful and the interdiction of k2 and M are not. 

All the algorithms solve several shortest-path problems, each associated with a 
specific possible outcomes, or an average of several outcomes (combined by an 
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approximation algorithm). Figure 5.1 shows how the different algorithms partition these 
16 possibilities. In the figure, every cell represents group of outcomes that the algorithm 
links, and so every cell represents one shortest-path problem that the subproblem solves. 
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Figure 5.1: Given an interdiction plan with 4 attempts, every algorithm 
for S-MXSP partitions the 16 possible outcomes into a different set of 
“cells” (divided by horizontal lines), and solves one shortest-path 
problem for each cell. 
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Algorithm H4 

In approximation H3, the reply strategy for each one of the outcomes in S" is the 
same path, in particular, the path that is shortest on average over all outcomes in S” . (In 
the example of Figure 5.1, S" is the large cell in the bottom of the list associated with 
H3.) The main idea of approximation H4 is to use information about shortest-path 
problems associated with outcomes in S' (in the example of Figure 5.1, those outcomes 
that are in separate cells in the top part of the list associated with H3) to define a possibly 
better reply strategy for outcomes in S" . 

For instance, consider outcome 0100 in Example 5.1. Intuitively, it seems likely 
that shortest paths that are associated with outcomes 1100, 0110 and 0101 are relatively 
short paths with respect to outcome 0100. Given outcome 0100, none of these 3 paths is 
necessarily the shortest path, but they may be better, i.e., shorter on average, than the 
single path that is good on average with respect to all the outcomes in S" . In 
approximation H4, the reply strategy for each of the outcomes in S" (the same set as in 
H3) is a randomized combination of optimal replies to related outcomes in S' . 

To define precisely approximation H4 of enumeration depth 2, we first assume 
that Pk~p for all arcs k. Let n be the number of interdiction attempts for a given 

interdiction plan x. For m = /?^'”^(x) is the probability that x results in m 

successful interdictions (given by the binomial distribution), and 5"'(x) is the set of all 
outcomes with exactly m successful attempts in x . Now, given an interdiction plan x , 
we define the randomized reply strategy by defining ^ - (y | s) for all s e 5 : 
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(a) For all se5”(x)^5” ^(x), let ^,(y|s) be 1 for y(x,s) and 0 



otherwise. 

(b) For m = 0,...,n-3 and all se5'"(x) we first identify the [” 2 ”*) elements of 
5”“^ (x) where the same m attempts are successful too, denoted by 



s\s^,...,s^ ^ K (Out of the n-m interdiction failures in x corresponding to 
s e5”*(x), we need all combinations of two failures, each one corresponding to a 
different s e5”~^(x).) Let, 



^^x(y|s) = ^ 





r /n-m\ ' 

y eyjx,s^),y(x,s^),...,y(x,s^ ^ 


l/{-) 


0 


otherwise 



By Proposition 5.2 and Corollary 5.1, to establish an approximation algorithm 
the subproblem must calculate £[yj^.(x,j)] and £[i;^.y^(x,j)] for all keA. The 

following proposition shows how that can be done with respect to our definitions of 
approximation H4. 



Proposition 5.3: In approximation algorithm H4 of depth 2, for all k A, 

[5.7] £[yjt(x,5)] = ^/?^"‘^(x)£[yjt(x,j)|s s5'"(x)]+ ^p^'"^(x)£[yjt(x,j)|s €5 ”'^(x)] 

m=n-2 m=0 

[5.8] £[j^y^t(x,5)] = 2/7^'"^(x)£:[5^yjt(x,5)|s eS'"(x)] 

m=n-2 

m=0 
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Proof: By definition, for all k eA 



^fc(x,5)] = 2^/?^'”^x)£[y;t(x,s)|s e5"'(x)] and 

m=0 

e5^(x)], 



m=Q 



and so it is enough to show that for all m^n-3 and for all k & A 

£[y;fc(x,s)|s €5'”] =£:[yjfc(x,s)|s €5”'^] and 

€5'”] =£:[^jfc|s e5"'(x)]£[y^(x,5)|s e5"~^(x),4 =1 



But, these are straightforward results of our definition of the reply strategy in 
approximation algorithm H4 of depth 2 and the assumption that Pfr = p for all k ■ 

Remark; We conjecture that a modified reply strategy can be defined such that 
Proposition 5.3 holds even if the probability that an interdiction attempt is successful is 
not the same for all interdictable arcs. That modified strategy needs to assign different 

weight to different paths in the definition of the reply strategy for s e S"* , m < « - 3 , in 
order to keep [5.7] and [5.8] valid. 

In order to calculate £[y;^(x,j)] and for all k&A it is enough to 

calculate the probability of each outcome s €5”(x) (x) , and to find the 

shortest-path given this s , since for all k & A : 



n-3 n 



(a) 


= 2;/”>®,and 

m=0 m=n-2 




(b) 


5 p^'”^(x)£[5fc 1 s e S'"(x)] ^P;^- 


|;/'”)(x)£[;;t s€5"-(x)] 



m=0 m=m-2 
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D. A LOCAL-SEARCH PROCEDURE 



Our experience with the different decomposition algorithms for solving the 
deterministic MXSP, as well as preliminary computational results for S-MXSP (reported 
later), indicate that the running time of the master problem is very sensitive to the number 
of Benders cuts. In fact, even though the subproblem of S-MXSP requires more work 
compared to the subproblem in MXSP, in both cases the limits of the decomposition 
algorithms are determined by the difficulty in solving the master problems, at least with 
our current technology. 

In order to solve the problem with fewer master iterations (every iteration adds 
one more Benders cut), the hybrid algorithm can use a local-search procedure to generate 
more than one covering cut per iteration. Those cuts are added to the master problem, 
and tighten it. This discussion suggests that a local-search procedure may also be helpful 
for the different decomposition algorithms (exact or approximate) for S-MXSP. We 
describe a possible local-search procedure for the exact decomposition algorithm. 
However, the same approach may be use to develop a local-search procedure for all the 
approximation algorithms, too. 

Let yj(s) be any reply strategy, deterministic or randomized, that the subproblem 
can define given interdiction plan x . It may be, for instance, that y- (s) is the second 

shortest path given x and s, or the second shortest path in the list of paths generated by 
our Local_Search procedure we described for MXSP. Then, by Proposition 5.2 we can 

define c(x)= ]^£[cjty(x,Sj 5 .)] and Vjt(x) = obtain the valid 

keA 

Benders cut z < c(x) -b But, as we discussed earlier, too many Benders cut is 

keA 



-91 - 



not a good idea. Therefore, the local-search procedure might only generate a covering 
cut based on this (slack) Benders cut, and add it to the master problem. (If c(x) exceeds 
the current value of z , we will not include this cut in the master problem, but rather, as in 
Algorithm 2E for MXSP, put it aside for possible later use.) 

For instance, suppose we choose y/^(x,s) as the second shortest path given x and 

s . Then, when we compute the exact Benders cut we also find the second shortest path 
in each of the subproblems. Those second shortest paths are used to compute a slack cut, 
and the covering cut associated with this slack cut is added to the master problem. Note 
that we can generate more than one slack cut per iteration by finding additional paths for 
every subproblem. 

E. COMPUTATIONAL EXPERIENCE 

To test the different algorithms, we use the shortest-path network and 
computational platform described in Chapter II. However, a new vector p is added, 
where pk is the probability an interdiction attempt on arc k is successful. For the results 
reported here, we use the same success probability for every arc, denoted by p. 

The following tables summarize the results for several different cases. We note 
that these are preliminary results and that none of the algorithms includes a local-search 
procedure. Thus, the exact and approximation decompositions are accomplished with 
Algorithm 1. In the case of approximation HI, we could have used the Local_Search 
procedure developed for deterministic network interdiction (that might have reduced its 
running time significantly, as seen in Chapter II) but we did not, in order to allow a fair 
comparison between this algorithm and the others. 
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Table 5.1 compares approximation HI, approximation H2 and the exact 
algorithm. In both approximations we use a 1% approximation gap, but, as the table 
shows, that translates to a 12-20% true optimality gap for our test problems. (See 
principles (f) and (i) in Section 5.C) for the definitions of approximation gap and 
optimality gap.) 

We solve the same problems with the exact algorithm up to a 12% or 15% 
optimality gap. Table 5.1 shows that the exact algorithm has similar running times to the 
approximations for this parameter setting. But, since computational effort in the exact 
algorithm is clearly more sensitive to the total amount of interdiction resource (we do not 
see this in the table because ro is relatively small), the approximation algorithm would 
probably outperform the exact algorithm with larger values of ro. In any case, the 
running times indicate that we cannot successfully increase ro significantly, even in the 
approximations, without adding a local-search procedure or other effective enhancement. 

H2 takes much more running time than HI, but yields a similar optimality gap. 
The major disadvantage of H2 is in the master problem level (the extra work in the 
subproblem is insignificant here.) The cuts in the master problem of H2 are less effective 
(compare the number of iterations the two algorithms need for convergence, Nh 2 versus 
Nhi), probably because every cut in H2 represents a weighted combination of multiple s-t 
paths, and not a single path. Thus, in the cuts of H2 the non-zero coefficients are smaller 
on average, and so the cuts are “flatter,” (in the geometric sense) compared to the cuts in 
HI. (Notice that each cut in the exact algorithm is a weighted combination of many s-t 
paths and so is even flatter. As a result, the exact algorithm requires more iterations to 
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achieve a 12% gap, than approximations HI and H2 need to achieve a 1% approximation 
gap, which is actually 1% optimality gap with respect to the modified objective.) 

Note also that: 

(a) The optimality gap of both approximations HI and H2 becomes smaller, though 
not small enough, when p increases, and 

(b) The optimality gap of all approximations increases when we have more 
interdiction resource. 

(c) For the case p = 0.7 and ro = 15 (problem set IS), we used the exact algorithm to 
solve the same problem to a 2% optimality gap. It turns out that the optimality 
gap obtained by the approximation algorithms (and the exact algorithm when used 
with a 15% gap) depends primarily on poor upper bounds rather than poor 
interdiction plans x. About 20% of the gap is due to the difference between the 
optimal objective value and the lower bound (i.e., the objective value of the 
incumbent solution), while the weak upper bound is responsible for 80% of the 

gap. 
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Approximation HI 


Approximation H2 


Exact Algorithm 


Problem 


P 


''0 


LBhi 


UBh, 


“/ogHl 


Thi 


Nh. 


LBh2 
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%gH2 
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Nh2 
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Te 


Ne 
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0.7 
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18.3 


15 


20 


17.8 


20.8 


16.5 


38 


33 


18.0 


20.6 


15 


14 


22 


2S 


0.7 


20 


18.4 


22.0 


20.1 


84 


33 


18.4 


21.8 


18.6 


243 


54 


18.5 


21.3 


15 


87 


37 


3S 
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18.8 


21.2 


12.6 


21 


24 


18.8 


21.1 


12.3 


36 


21 


18.9 


21.0 


12 


39 


32 


4S 


0.8 


20 


19.5 


22.5 


15.6 


102 


39 


19.5 


22.4 


14.4 


266 


53 


19.5 


21.7 


12 


255 


60 



Table 5.1; Computational results for S-MXSP. The test network has 64=8x8 timer nodes (a=238), c=10, rf=10 
and r=5. The approximation gap for HI and H2 is 1%. 

Legend; LB* Lower bound achieved by Algorithm h. 

UBa Upper bound achieved by Algorithm h . 

%gA True optimality gap achieved by the Algorithm h. 

Ta R unnin g time in CPU seconds for Algorithm h. 

Na Number of iterations for Algorithm h. 



Table 5.2 compares approximation H3, approximation H4 and the exact 
algorithm (both approximations are of enumeration depth 2). We solve the exact 
algorithm with 5% and 10% optimality gaps, and in order to obtain similar results we set 
the approximation gap to 1% and 4% in H3, and to 4% and 8% in H4. 

The table shows that approximation H3 cannot establish small optimality gaps. In 
problems 7S we solve approximation H3 with a 1% approximation gap but obtain an 8% 
true optimality gap. On the same problems, approximation H4 with a 4% approximation 
gap yields a true optimality gap of 6.5%. Thus, approximation H4 estimates the reply to 
outcomes with 3 or more failures better than approximation H3, and so the modified 
objective of H4 is closer in its value to the optimal objective. 
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Table 5.2 also demonstrates, just as Table 5.1, that the approximations and exact 
algorithm have similar running times, when the exact algorithm is solved with a similar 
true optimality gap. But, with increased ro the approximations would probably 
outperform the exact algorithm. 
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333 


197 
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18.5 


19.7 


6.5 


352 


117 


18.6 


19.5 


5 


344 


107 



Table 5.2; Computational results for S-MXSP. The test network has 64=8x8 inner nodes (^7=238), 
c=10, <#=10 and r=5. 

Legend: %g Approximation gap. 

All other legend data as in Table 5.1 



F. CONCLUSIONS 

In this chapter we have shown how our approach for solving deterministic 
system-interdiction problems can be extended to solve one t5T>e of stochastic system- 
interdiction problem. We revisited the shortest-path network-interdiction problem to 
demonstrate this, but this time assumed that interdiction success is uncertain. As 
expected, the stochastic problem is much more difficult to solve than the deterministic 
one, mainly because the subproblems in our decomposition algorithm generate “flat” 
cuts, and so the master problem requires more iterations to converge. Surprisingly, this is 
even true for an exact algorithm with exponential complexity in the subproblems. From 
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our experience with the deterministic interdiction problem (and the shortest-path 
network-defense problem) we know that a local-search procedure will likely accelerate 
the decomposition algorithms for the stochastic problems, but we have not yet 
implemented such a procedure. 

We compared the exact decomposition algorithm to several approximation 
(decomposition) algorithms. On our test problems, the exact and approximation 
algorithms require similar running times (when the problem is solved to the same 
optimality gap) but in larger problems the approximations are likely to be better, because 
they don’t require an exponential amount of work in the subproblem phase. 

Among the approximations, algorithm H4 gives the best results. For a given 
optimality gap, running times for approximation H4 are similar to those of the other 
approximations, and of all the approximations tested, approximation H4 establishes the 
smallest optimality gaps. Approximation H4 finds the optimal reply of the network user 
for the most likely outcomes out of the interdiction attempts, and use that to approximate 
(and bound) the optimal network user replies for all other outcomes. 

Last, we note that our approach for solving S-MXSP can be easily applied to 
other interdiction problems, where the success of each interdiction attempt is uncertain. 
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VI. CONCLUSIONS 



This chapter reviews the accomplishments of this dissertation and suggests 
opportunities for further research. 

In this dissertation we have discussed several problems concerning system 
interdiction and defense, using a shortest-path network-interdiction scenario to 
demonstrate our approach. We have addressed the following questions; 

(a) What is the best interdiction plan? 

(b) What is the best defense plan against a prospective set of interdictions? 

(c) What is the best interdiction plan when interdiction attempts might fail? 

The deterministic shortest-path network-interdiction problem (MXSP) is 
discussed in Chapter II. MXSP assumes that a network user traverses a shortest path 
given the results of a prior interdiction, and the question is “What interdiction plan will 
maximize the length of that shortest path?” When interdiction of an arc increases its 
effective length by a finite amount (called “delay”), and the network user traverses the 
shortest path given the interdiction, we have shown how to formulate the problem as a 
mixed-integer program (MEP), and how to solve the problem with Benders 
decomposition. However, when interdiction of an arc makes the arc impassable, those 
solution techniques can be ineffective, and we therefore devised a second decomposition 
algorithm, in which the Benders master problem is replaced by a set-covering problem. 
Last, we combined the first two decomposition algorithms into a hybrid decomposition 
algorithm which gives the best computational results. All tests were performed on 
randomly generated networks, it would be interesting to repeat those tests on more 
realistic problems. 
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The hybrid algorithm includes several special enhancements, derived through the 
first two decomposition algorithms, especially (/) integrality cuts for the Benders master 
problem along with a method to tighten those cuts, and, (ii) covering constraints — ^which 
are best viewed as integrality cuts in this context — and a method to generate and lift 
them. Those enhancements were shown to be effective for solving MXSP. It would be 
interesting, when delays are finite, to see if the integrality cuts and/or covering 
constraints derived from the decompositions would be useful as (integrality) cuts for 
reducing solution times for MXSP solved as a MIP. It might also be possible to add 
some constraints, possibly aggregated, from the MIP to the decomposition master 
problems to tighten their relaxations and thereby improve solution times. 

In Chapter HI we showed how the techniques used to solve the shortest-path 
network-interdiction problem can be used for solving other interdiction problems where 
an interdictor tries to reduce the effectiveness of an adversary’s system through 
interdiction. Thus, our methods can be used to interdict a shortest-path system with side 
constraints, disrupt activities in a PERT network in order to maximize project completion 
time, reduce the effectiveness of an economic system modeled as an optimization 
problem, etc. 

In a wider perspective, the special enhancements we suggest for the basic master 
problem in Benders decomposition, i.e., the integrality and covering cuts, may be helpful 
while applying Benders decomposition to other problems with binary “complicating” 
variables. Consider, for example, a problem of the design and operation of a production 
and distribution system. These problems often involve (/) “strategic variables,” which 
constitute binary decisions over facility locations and other issues of infrastructure, and. 
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(/■/) “operational variables,” usually assumed continuous. A common way of solving 
those problems is through Benders decomposition (e.g., Brown et al. 1987), where the 
subproblem is a (relatively simple) operational problem and the master problem deals 
with the binary strategic variables. It might be possible to improve running times of such 
decompositions by adding the integrality cuts and/or covering constraints to the Benders 
master problem, as was done with MXSP. 

In Chapter IV we discussed a system-defense problem in which the system user 
can defend some of his activities, resources, etc., against prospective interdiction. The 
system-defense problem turns out to be a system-interdiction problem in itself, where the 
defender interdicts the interdictor’s system. This view leads us to solve the problem of 
defending the shortest path (in this problem the network user defends some of the arcs in 
a shortest-path network and afterward the interdictor finds the best interdiction plan on 
the undefended arcs of the network) with nested decomposition algorithms. The 
algorithms we use include the enhancements developed for MXSP (and adapted for more 
general system-interdiction problems) and special procedures that take advantage of the 
structure of the nested decomposition. It would be interesting and challenging to apply 
the nested decomposition algorithm to other system-defense problems, too. 

In Chapter V we showed how our approach for solving deterministic system- 
interdiction problems can be extended to solve a shortest-path network-interdiction 
problem where interdiction success is uncertain, and the interdictor wishes to maximizes 
the average length of the post-interdiction shortest path. Even this “simple” stochastic 
scenario is much more difficult to solve exactly compared to the deterministic analog 
because evaluating the expected shortest-path length, given an interdiction plan, requires 
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exponential work. 

To deal with the complexity of the stochastic problem we devised several 
decomposition algorithms that approximate the expected length of the shortest path after 
interdiction. In these algorithms, the subproblems involve only at a subset of the possible 
outcomes, or aggregate several outcomes together, so that the number of scenarios 
considered by the subproblem is manageable. Those approximations yield upper bounds 
on the optimal objective value. A lower bound can be found, when computationally 
feasible, by calculating the exact objective value (i.e., by considering all possible 
scenarios) for one feasible interdiction plan. A good feasible interdiction plan (one that is 
likely to give a good lower bound) is often suggested by the near-exact solution of the 
approximation. 

Our limited computational experience includes only the basic Benders 
decomposition for the exact and approximating algorithms. Unfortunately, the 
subproblems for any of these algorithms generate “flat” cuts, and such cuts cause the 
master problem to require more iterations to converge compared to analogous 
deterministic problems. Our computational tests show that all algorithms can have similar 
running times for the same optimality gap. However, with increased interdiction 
resources, the approximations are likely to outperform the exact algorithm. Further 
programming work is needed to check the effectiveness of the integrality cuts and the 
other basic decomposition algorithms in this stochastic scenario; these techniques might 
help compensate for the problematic flat cuts. 
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Our model assumes uncertainty only with respect to the success of each 
interdiction attempt, but other types of uncertainty might be important as well. For 
instance, in a shortest-path interdiction problem, the interdictor might not know the exact 
length of certain arcs, the exact location of the source and target nodes, etc. More work is 
needed to accommodate these variations of the model. 

Among the approximation algorithms, of special interest is an algorithm that finds 
the shortest paths with respect to the most likely scenarios and uses those to approximate 
(and bound) the shortest path with respect to all other outcomes. This algorithm seems to 
give the best results but correctness is only proven for the case in which all arc 
interdiction-success probabilities are equal. 

The approximation algorithms take advantage of the special structure of the 
stochastic network-interdiction problem, in particular, the fact that first-level variables 
(interdiction decisions) affect only the cost of the second-level activities. (In a shortest 
path problem the cost of traversing an arc is the arc’s length). However, the same 
structure can be found in other stochastic programming problems. Consider a stochastic 
programming problem of the form 

max £[/(x)] 

xeX 

T 

where / (x) = max c y 
yer 

s.t. A^y<d + Bx 

where B = diag(b) . For instance, this might be a production problem where; 
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(a) The variables x are binary decisions regarding which markets to expand. 

(b) The demand at facility j is the original demand dj plus the stochastic result of the 

market expansion bjXj . (xj =0 implies no change in market J.) 

(c) All other parameters (production capabilities and costs, shipping costs, etc.) are 
deterministic. 

If we take the dual of the inner maximization, we obtain a max-min problem with the 
same structure as the stochastic system-interdiction problems we have solved. Thus, this 
problem can be solved with the approximation algorithms we have devised. 

This thesis contributes mostly to the areas of system interdiction and defense, but 
our techniques may be helpful in other applications solved by Benders decomposition 
including certain stochastic-programming problems. Our results should provide ample 
opportunities for further research in all of these areas. 
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APPENDIX A. BI-LEVEL LINEAR PROGRAMMING 



The system interdiction problem is a min-max, mixed integer, bi-level linear 
program. In this appendix we introduce the definitions of a general bi-level linear 
problem and its max-min and mixed-integer variants. The focus of the discussion is on 
existing algorithms for bi-level problems, and their applicability to the special structure 
of the system interdiction problem. 

A. BI-LEVEL LINEAR PROGRAMMING 

The general Bi-Level Linear Program (BLLP) has attracted much attention in the 
last 30 years (e.g., the literature survey in Vicente and Calamai 1994, the reviews in Ben- 
Ayed 1993, and Wen and Hsu 1991). Many algorithms have been suggested to solve the 
BLLP and the model has been applied to a number real-world problems. Nonlinear cases 
are treated in a few papers (e.g., Falk and Liu 1995) and recently, the more general case, 
where part of the variables are set as a function of the others through any type of 
equilibrium constraints, is explored too (Luo, Pang and Ralph 1996). 

A bi-level program considers two decision-makers, or players, who may be 
competitive. Each player controls some activities and wishes to optimize his objective 
function, which is a function of all the activities, including those that the second player 
controls. The problem can be viewed as a non-zero-sum game where one of the players, 
the leader, plays first. Due to common constraints, the actions of the leader influence the 
feasible region of the second player, the follower. In his turn, the follower optimizes his 
objective function, in view of the decisions of the leader, but independent of the leader’s 
objective function. We assume perfect information, that is, the leader knows the 
objective function and the constraints of the follower and hence can predict the follower’s 



- Ill - 



reaction to any decision he makes. 

The mathematical programming formulation of BLLP is; 

[BL] min c,^x + C 2 ^y 

xeX,yeY(x) 

where X = {x |Z>x < d, x > 0}, and 
Y(x) ={y|y€argmin C 3 ^y 

s.t. y4y<b-Bx 

y^o } 

Note that there is no need for a term like C 4 ^x in the follower’s program because 
X is a parameter there, not a variable. 

7(x) is called the follower’s rational reaction set. It is assumed that 7(x) is non- 
empty for all xeX The inducible region is defined as IR= { (x,y) | Z)x < d, x > 0, y s 
7(x) }. With this notation, we can rewrite [BL] as 

[BLl] min{ci^x + C 2 ^y l(x,y) elR}. 

The feasible region to [BLl] may not be convex. Therefore, the problem can be 
difficult to solve and may have local optima. However, let S be the feasible region of 
[BL], i.e., S = { (x,y) | Dx <d, Ay + Bx< b, x > 0, y > 0). Then, there is a solution of 
the problem that is a vertex of S (Bard 1984). As we shall see, many algorithms try to 
take advantage of that result by performing an implicit search of all possible solutions 
without enumerating all extreme points of S. 
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B. THE LINEAR MIN-MAX PROBLEM 

[LSIP] without the binary constraints is a special case of [BL] with Cj = 0 and 

C2 = -C3 . It is also referred to as the Linear Min-Max Problem (LMN): 

[LMN] min c^y 

xeX,yey(x) 

where X = {x |Z>x < d, x > 0}, and 
={y |Ay <b-Bx,y >0}. 

Remark: In [BL], If 7(x) is not always a singleton, and C2^y might not have the same 
value for all y e T(x), then a solution to [BL] may not exist (Bard 1991). However, in 
[LMN], Cj = 0 and so has the same value for all y g 7(x). Thus, when F(x) is 
bounded for all xgAT, an optimal bounded solution for [LMN] must exist. 

LMN is equivalent to a structured quadratic problem. Hence, any nonlinear 
algorithm is a candidate solution method. However, this quadratic objective formulation 
is non-convex and the problem is, consequently, difficult to solve. To see the 
equivalence, take the dual of the follower’s problem in [LMN] (w are the dual variables) 
to obtain: 

[LMNl] min (b - Bx)^w = w^b - w^Bx 

X,W 

s.t. Dx < d 
> c 

X > 0, w > 0. 
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C. THE BI-LEVEL MIXED-INTEGER PROBLEM 

The problem we are interested in, system interdiction, falls into the category of 
the Bi-Level Mixed Integer Program (BLMIP). Let Sx and Sy represent the binary, and/or 
integer and/or non-negativity restrictions on the values of the variables x and y, 
respectively. Then, the formulation of BLMIP is the same as [BL] except that xe5x 
replaces x > 0 and replaces y > 0 ; 

[BLMIP] min c, + c^Jy 

xeX,yey(x) 

where X = {x |£>x < d, x and 

y(x) ={y|yeargmin c^^y 

s.t. /4y<b-Bx 

y } 

In the system interdiction scenario, Sx<^ {0,1}” while and closed (i.e., 

all the follower’s variables are continuous). The general definition of BLMIP is more 
flexible, however. 

D. APPLICATIONS 

The ability of the BLLP model to represent decentralized decision processes, 
where several different objective functions are incorporated simultaneously, has attracted 
practitioners during the last 30 years. However, the difficulty in solving BLLP constrains 
the number of actual applications and few models have passed beyond theoretical 
formulation. Furthermore, in a recent review of the BLLP literature, it is stated that “the 
overwhelming majority of real-world problems are formulated and solved as single level 
programs even when they are virtually bi-level (Ben-Ayed 1993).” 
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Most of the models and work in the area of involve BLLPs with economic 



interpretations (Fortuny- Amat and McCarl 1981). The upper level (leader) is the 
government, or the head of an organization, that controls resources, or policy measures 
such as prices, taxes and subsidies. The lower level (follower) is the private sector, or the 
lower level of the organization, which optimizes its own objective function, after the 
higher level sets the rules. Actual work in this area includes agricultural planning, 
regulation of the oil industry and the imperfect cartel in the international coal market. 
For a list of references see Vicente and Calamai (1994) and Ben-Ayed (1993). 

The BLLP model has also been applied to network-design problems for 
transportation and communication networks. The two-level formulation takes into 
account the reaction of users to the improvements made in the system and hence can lead 
to a better plan for the system manager (e.g., LeBlanc and Boyce 1986, Ben-Ayed, Boyce 
and Blair 1988). 

As one might expect, military models involving worst-case analysis through max- 
min formulations were popular during the arms race (e.g.. Bracken and McGill 1973). 
However, the models, based on weapons attrition theory, are non-linear, and typically the 
leader’s activities do not change the follower’s feasible region. Therefore the solution 
approach taken there is not applicable to LSIP. 

In the LMN framework, we are familiar with two military-oriented applications: 

(a) Max-flow network interdiction (e.g.. Wood 1993). 

(b) Shortest-path network interdiction (Golden 1978, Fulkerson and Harding 1977). 
In Chapter II we discuss in details a version of this problem, in which 
interdiction decisions are binary, and not continuous, variables. 
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E. ALGORITHMS FOR LMN AND BLLP 



Currently, few algorithms exist that take advantage of the special structure of 
LMN. On the other hand, any of the many algorithms that were suggested for BLLP can 
be used to solve LMN as well (Bard and Falk 1982). These algorithms are of interest 
because; 

(a) We can relax the binary constraints of LSIP if all the extreme points of the leader’s 
feasible region are binary. Thus, in some cases, an algorithm for BLLP (or LMN) 
solves LSIP directly. Also, 

(b) As we shall see later, most of the existing algorithms for mixed-integer problems 
like LSIP incorporate a continuous-BLLP algorithm to solve sub-problems. 

Some of the BLLP algorithms are not well-suited to solving LMNs. As we said 
earlier, the LMN is a special case of BLLP with C 2 = -C 3 and Cj = 0 . The correlation 
(in the usual statistical meaning) between C 2 and C 3 is therefore -1 for the LMN. 

Significantly, most of the existing algorithms for BLLP are positive in the sense that the 
algorithm works best when there is a strong positive correlation between C2 and C3, i.e., 

when the objective functions of the leader and the follower are similar, with respect to the 
follower’s variables. A positive algorithm is likely to have poor performance when 
applied to LMN. To solve LMN, we shall use a non-positive algorithm, i.e., an algorithm 
that performs well when there is a strong negative correlation between C 2 and C 3 . 

While describing the existing algorithms for LMN and BLLP next, we classify 
each one as positive or non-positive. The classification is based on algorithmic structure 
and is by no means precise, but, in some of the cases, reported computational experience 
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also supports our classification. However, unless mentioned specifically, experience with 
large problems has not been reported. 

1. Implicit Enumeration of Possible Bases 

Recall that S is the joint feasible region of the two levels in [BL] and that there is 
an optimal solution at a vertex of S. A few algorithms try to use this result by implicit 
enumeration of the bases of the polytope that defines S. Usually, the algorithm starts by 
letting the leader control all the variables in order to find his optimal solution over the 
vertices of S, regardless of the follower’s objective. Fixing the leader’s variables, the 
algorithm solves the follower’s problem to determine if the solution is in the inducible 
region. If it is, we have reached the optimal solution. Otherwise, we can conclude that 
the basis, or the vertex, that the leader chose is not optimal. Several approaches have 
been suggested to continue the search over S’s vertices: 

(a) A branch-and-bound process can be used where each new branch is a sub-problem 
with one of the basic (and positive) variables from the leader’s current basis forced to 
0. This algorithm was originally suggested for LMN (Falk 1973). 

(b) One variant examines only the follower’s bases (Candler and Townsley 1982). 
Strictly speaking, this algorithm is polynomial when the follower controls a constant 
number of variables (Liu and Spencer 1993), but it becomes computationally unusable 
when the number of those variables grows to even modest levels. 

(c) The “Kth-best” algorithm (Bialas and Karwan 1982) repeatedly finds solutions for the 
leader, regardless of the follower’s objective, until the Kth best happens to be in the 
inducible region. 

All of the algorithms just mentioned are positive algorithms because the leader’s 
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objective is favored and in each major step the leader controls all the variables. These 
algorithms cannot be efficient in case of large LMN or LSIP problems. 

2. Cutting-Plane Algorithm (Vaish and Shetty 1977) 

This algorithm works on the [LMNl] formulation. First it iterates (with 
appropriate degeneracy-prevention rules) between the x and w variables until a stationary 
point, that may only be only locally optimal, is achieved. Then it computes how far it can 
move from the extreme point in any feasible direction (with respect to the leader’s 

variables) without improving the objective function, w b - w 5x , cuts this part from X, 
and starts again. This algorithm works on the LMN problem, but not the BLLP. (BLLP 
doesn’t fit into formulation [LMNl].) Hence, we classify it as a non-positive algorithm. 

3. Branch-and-Bound on KKT Complimentary Conditions (Bard and 
Moore 1990) 

The “BB-KKT algorithm” replaces the follower’s problem with his KKT 
optimality conditions. This way, the BLLP is converted to a single-level problem, and a 
branch-and-bound procedure is used to implicitly examine all combinations of the non- 
linear complementary slackness conditions. Let w be the vector of dual variables 
associated with the constraints ^4y + Bx < b. Then, the KKT-formulation of BLLP is: 
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[BL2] 



min 

x,y,w 


Ci^x + C2^y 




s.t. 


Dx 


<d 




Ay + Bx 


<b 




A^w 


> c 




(^^w-C3)^y 


= 0 



{Ay + Bx - b)^w = 0 
X > 0, y ^ 0, w > 0. 

Random problems with 40 constraints and 100 variables, 40 of them controlled by 
the follower, were solved by Bard and Moore, in 300 CPU seconds on average, on an 
IBM 308 1-D. The main factor that increases the CPU time is the number of variables 
controlled by the follower. This result is expected since this is clearly a positive 
algorithm; In any relaxed iteration of the branch-and-bound process, the “BB-KKT” 
algorithm controls the leader’s and follower’s variables together. 



4. Penalty on Duality Gap (Anandalingam and White 1990) 

Here, the BLLP is transformed into a single-level program by replacing the 
follower’s problem with a penalty on his duality gap (or equivalently, with a penalty on 
the complimentary slackness conditions in formulation [BL2]). The reformulation of 
BLLP is: 
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[BL3] 



min Ci^x + C 2 ^y-^(c 3 ^y- w^(b-Bx)) 

x,y,w 

s.t. Dx <d 

^y + fix < b 

w^/4 > C3 

X > 0,y > 0,w >0. 

Let the optimal solution of [BL3] be (x*,y* w*). x* is feasible in the leader’s 
problem. Moreover, for k sufficiently large, the duality gap must be zero, so we must 
have y*sF(x*). Two different algorithms have been suggested to solve [BL3]; 

Let ^(w) = min{ci^x + - k{c-^^y - w^(b - fix)) \D% < d,Ay + fix < b,x > 

x,y 

0, y > 0} then, [BL3] is equivalent to min{0(w) A > C 3 ,w > 0), which is a difficult 

W 

concave minimization problem. Anandalingam and Apprey (1991) solves this problem 
with a successive underestimation method proposed by Falk and Hoffman (1976). 

A second way to solve [BL3] is through a “modified simplex algorithm” (Onal 
1993), which is a quadratic programming algorithm (Beale 1959) that seems to become 
simpler in the special setting of [BL3]. The algorithm maintains a basic feasible solution 
and, in each “simplex” iteration, it evaluates the partial derivatives of the objective 
function with respect to the non-basic variables (through a relatively complex matrix 
calculation). Then, it pivots and chooses the entering variable in the usual way. In each 
major iteration, a local optimum might be found, and upper bound (LOB) is updated and a 
cut, Cj^x + C 2 ^y ^ UB-s , is added to the problem. The problem is re-solved until no 
feasible solution is found; then we have an s-optimal global, solution. 
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It is not clear whether these two algorithms should be classified as positive or non- 
positive. In both algorithms, the primal variables of the leader and the follower are 
controlled simultaneously, and this is a positive approach. However, both algorithms 
have a “correction” step where only the follower’s dual variables are considered. That 
might be considered as a follower’s step. 

5. Complementarity Approach (Judice and Faustino 1992) 

The idea of transforming formulation [BL2] into a parametric linear 
complementarity problem was suggested by Bialas and Karwan (1984) but their 
algorithm isn’t guaranteed to converge to an optimal solution (Ben-ayed and Blair 1990). 
In 1988, Judice and Faustino suggested a modification that is guaranteed to converge to 
an s-optimal solution. The algorithm was tested on random problems with up to 150 
constraints and 250 variables, and was shown to have relatively good performance 
(Hansen, Jaumard and Savard 1992). However, the performance of the algorithm 
degrades significantly when tested on problems with “conflicting” objectives. This is a 
clear evidence that the algorithm is positive. 

6. Variable Elimination (Hansen, Jaumard and Savard 1992) 

This algorithm performs branch-and-bound on the constraints of the follower’s 
problem. At each node on the enumeration tree, one more of these constraints is forced 
to bind and one of the follower’s variables is eliminated. Then, the algorithm lets the 
leader control the follower’s remaining unfixed variables and the leader’s problem is 
solved to obtain a local lower bound on the leader’s optimal solution. This local bound 
may not be global because some of the follower’s variables have already been set. If this 
local lower bound is worse than the bound from a feasible solution, this node can be 
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eliminated. The algorithm is implemented using a depth-first search of the enumeration 
tree and each time the search reaches a leaf (all follower’s variables are set), the leader’s 
problem is solved, a feasible solution is exposed and the global upper bound on the 
follower’s optimal solution is updated, if appropriate. 

The algorithm was extensively tested on problems with up to 1 50 constraints and 
250 variables. It was shown to be much better than any other tested algorithm, including 
branch-and-bound on the KKT complimentary conditions (Bard and Moore 1990) and the 
Judice-Faustino algorithm. However, like those two algorithms, certain random 
problems require ten times more computational effort than other problems, and sensitivity 
to the number of follower variables is observed. Furthermore, a special set of tests 
indicates that the running time decreases when the leader’s and follower’s objective 
functions become more similar. Those results indicate that this is a positive algorithm. 
Indeed, the lower bound on the follower’s objective used for fathoming will rarely be 
effective in the min-max case. 

7. A Hybrid Tabu-Ascent Heuristic (Gendreau, Marcotte and Savard 
1996). 

This algorithm attempts to solve BLLP to near-optimality by a combination of a 
few heuristic methods. After a feasible solution is found, the algorithm iterates between a 
local-ascent search and a tabu search. The first technique is used to find an optimum that 
might be local, and the second is used to move away from a local optimum, to an area 
where a solution better than the last local optimum may exist. When the tabu search fails 
to find such an area, the algorithm stops. 
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The algorithm was tested and compared to the variable elimination algorithm on a 
set of random problems, on an HP730 workstation. The largest problems had 200 
variables, 75 constraints and a relatively dense constraint matrix (25% non-zero). On 
those problems, the heuristic algorithm used 3-13 minutes of CPU time and found better 
solutions than the exact algorithm found after 60 minutes of CPU time. 

Recall that the variable elimination algorithm has significant variation in running 
time between problems of the same size, probably because it is a positive algorithm. The 
heuristic algorithm has a much more stable running time. Hence, we can guess that the 
heuristic is using a non-positive approach. 

F. ALGORITHMS FOR THE BLMIP 

Only a few papers have been written concerning solution procedures for the bi- 
level mixed integer programming (BLMIP). 

1. Parameterized integer program (Bard and Moore 1992) 

The algorithm works only when both x and y are binary. It works by solving 
instances of the following formulation 

[BLMIPl] max 
x.y 

s.t. Dx <d 

Ay + Bx < b 

Ci^x + C2^y ^cc 
X eX,y ey 

where a is a parameter, equal to the best objective value found so far less 1. (It is 
assumed that all objective coefficients are integer.) 
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The algorithm implicitly enumerates the enumeration tree associated with the 
variables x. In each iteration, some of those variables are set to 0 or 1 and the remaining 
problem is solved as a standard MIP. When the MIP is infeasible, the branch is deleted. 
Otherwise, x is fixed and the follower’s problem is solved to obtain a feasible solution to 
the original problem, [BLMEP]. If the two solutions are the same, there is no need to 
develop this branch anymore. Otherwise the enumeration process continues by 
restricting x further. The algorithm uses specific branching and backtracking rules that 
were optimized with respect to a set of random problems. 

Computational results with random problems with up to 45 binary variables were 
reported. On average it took 100-150 CPU seconds on an IBM 3081-D to solve problems 
with 30 X variables and 15 y variables. Wide variations in the algorithm’s running time 
and sensitivity to the number of variables under the follower’s control were observed. 
Both these results are probably because this is a positive algorithm. If we substitute the 
LSIP conditions, c* = 0 and = -c^, then [BLMIl] would become almost useless and 
the algorithm might enumerate all possible values for x. 

2. “Classical” branch-and-bound (Moore and Bard 1990) 

The algorithm solves the mixed integer bi-level program similar to the way 
branch-and-bound is used to solve MIPs. At every node, a relaxed BLLP is solved and 
the enumeration tree is developed and fathomed with appropriate fathoming rules. When 
all the leader’s variables are continuous, as in LSIP, the three “regular” fathoming rules 
(infeasiblity, new integer solution and objective value worse then a known integer 
solution) are valid and used in the usual way. When all or part of the follower’s variables 
are restricted to integer values, the fathoming rules must be modified, however. 
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This algorithm’s performance hinges on the sub-algorithm that is used to solve the 
relaxed BLLP problems (which are NP-hard.) Originally the algorithm was implemented 
with the “BB-KKT algorithm”, which is positive, and not appropriate for solving LSIP. 
The algorithm could work with other sub-algorithms as well, but, recall that we have 
found no non-positive algorithm for BLLP that has been tested on large problems. 

3. Binary search algorithm (Wen and Yang 1990) 

As in LSIP, this algorithm assumes binary leader variables and continuous 
follower variables. However, the algorithm doesn’t assume the min-max case, and 
allows independent objective functions for the leader and the follower. 

The algorithm implicitly examines all possible values of the leader’s variables 
through a branch-and-bound process. At each node in the enumeration tree, a few of the 
leader’s variables are set to 0 or 1 and the algorithm uses an LP (which we won’t describe 
here) to calculate a local lower bound on the leader’s objective. This branch is fathomed 
if the bound is worse than the best solution value found so far. When all the variables x 
have been set to 0 or 1, the follower’s problem is solved to obtain a new feasible solution. 

The algorithm is positive, and when it’s applied to a problem such as system 
interdiction, the lower bound from the LP will not be useful at all. Thus, the algorithm 
might enumerate all possible values for x. Moreover, even on random problems the 
algorithm’s performance is poor and the authors suggest using a heuristic, which we 
describe next. 
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4. Greedy Heuristic (Wen and Yang, 1990) 

This heuristic uses a greedy approach. At each iteration, a few of the leader’s 
variables are set to 1 and the follower’s problem is solved, as well as the LP mentioned 
above. Based on the dual variables of these solutions, a “judgment index” for the profit 
of the leader from setting each one of his variables to 1 is calculated. The variable with 
the maximum judgment index is set to 1. The algorithm starts with all the variables equal 
to 0. In each iteration, it sets one more variable to 1, and continues until no more 
variables can be set without violating feasibility. The heuristic is extremely fast and, on 
average, achieves better than a 3% optimality gap when tested on random problems. 
However, it is easy to build an example where this simple greedy heuristic will give 
arbitrarily bad results. 

The heuristic becomes simpler when it applied to LSIP. In every iteration, the 
follower’s problem is solved with the current set of interdicted activities, the “judgment 
index” of interdicting activity j is Uj times the dual variable of the constraint yj < Uj. The 
activity with the largest judgement index is interdicted, and the process continuous 
recursively. 

5. Reducing into BLLP (Vicente, Savard and Judice 1996) 

The last algorithm suggested so far for solving BLMEP transforms the problem 
into a regular BLLP. It is shown that if (a) y is continuous, (b) x is binary, (c) M is 
sufficiently large, and, (d) < 0 and C 2 ^ 0 (without loss of generality), then [BLMIP] 

is equivalent to: 
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[BLMIP2] min Ci + Co + Me^w 

xeX,(y,w)eyW(x) 

where X = {x |i)x < d, 0 < x < e} 

yW(x) = {(y, w) |(y, w) s arg max Cj^y + e^w 

y,w 

s. t. y4y < b - Bx 

w < X 

w < e- X 

y } 

where e is a vector of ones with appropriate dimension. 

As with other models using penalty terms, a key problem is to determine how 
large M should be. Vicente et al. suggest solving a sequence of BLLPs for increasing 
values of the penalty term. When the optimal solution in the ^th iteration has all leader 
variables at 0 or 1 we can stop and declare optimality. Otherwise M = Mj^ is increased to 

= (-Ci^X;t the non-integer optimal solution of the Ath 

iteration will give a positive and unattractive objective in the following iteration. 
Computational experience has not been reported and it is not clear whether computational 
difficulties are expected (due to the large penalty multiplier). 

G. CONCLUSIONS 

The main conclusion of this appendix is that the existing literature on general 
BLLPs does not suggest suitable algorithms for the special structure of LSIP. We 
support this statement with the following observations: 

(a) Only three exact algorithms (Bard and Moore 1990, Hansen, Jaumard and Savard 
1992, Section 16.3.3 in Shimizu, Ishizuka and Bard 1997) have been tested on 
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relatively large BLLPs. These algorithms all use a strongly positive approach, 
which means that they work better when there is strong correlation between the 
leader’s and follower’s objective functions. Hence, they would probably not be 
efficient when applied to min-max problems, like LSIP. Only a few exact 
algorithms (Vaish and Shetty 1977, Anandalingam and Apprey 1991, Onal, 1993) 
that may use a non-positive approach exist, and none of those has been tested on 
large problems. 

(b) Existing algorithms for the mixed integer case, BLMIP, are either positive by 
themselves (Bard and Moore 1992, Wen and Yang 1990) or are based on a BLLP 
algorithm as a subroutine (Moore and Bard 1989, Vicente, Savard and Judice 
1996). And, as mentioned above, there are no BLLP algorithms that seem to be 
attractive for solving LSIP. 

(c) None of the existing algorithms, exact or heuristic, is designed to take advantage 
of the special min-max structure of LSIP. Moreover, the algorithms have 
typically been tested on “random problems.” 

We have established that none of the existing algorithms for BLLPs or BLMEPs is 
really appropriate for LSIP. Therefore, in Chapters II and Chapter HI, we develop 
three new algorithms specially tailored to LSIP. The algorithms definitely exploit the 
special structure of LSIP and cannot be applied to a general BLMIP. In Chapter n, we 
demonstrate the effectiveness of the algorithms on a special-case problem, shortest-path 
network interdiction. 
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APPENDIX B: THE MORE GENERAL SYSTEM INTERDICTION PROBLEM 



Proposition 3.1; When Assumption 3.1 holds, the basic linear system interdiction 
[LSIP] min max c^y 

X€X yey(x) 



where 



X = |x e{04}” Rx < rj, and 
Y(x) ={y|Ay <b,0<y <C/(l-x),y e5} 



is equivalent to the more general linear system-interdiction problem defined as 



min max c^y-k^Vy 


xeX ye7(x) 




where X = | 


[x e{ 04 } 


y(x) =j 


[ysiT 



where t/=diag(u), S and S include integer or binary restrictions on elements of 

y and y respectively, A ,V ,A ^ R^^^ 

Remarks: 

(a) The general case, [LSIP*], allows an interdiction by the leader to affect one or 
more of the follower’s available resources and/or the availability and cost of the 
follower’s possible activities. 

(b) The restriction that By >0 is acceptable, because it is unlikely that an 
interdiction will relax any of the system’s constraints. 
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Proof: 



Set A = 



'A' 




b 




0' 




, b = 




, B = 




I 




u 




B 



, and V = [0] . Then, [LSEP] takes the form of 



[LSIP*]. 

For the second direction, we first show how to drop out the non-linear term in the 
objective function of [LSIP*]. Let us introduce n new variables, y ei?”, and n new 





y' 




c 




b' 




'a o' 


constraints, y > - V(1 - x). Set y = 


.y. 


, C = 


-1 


, b = 


VI 


, A = 


1 

1 



B = 



B 

y 



and y = [0]. 



These new constraints and the unattractive coefficients of y in 



the objective function, guarantee that jj = ^(Yy)j >f Xj =1 (recall that V 

Xj=\ 

Therefore, for every x eX the solution of the inner maximization problem stays the 
same, and so this transformation doesn’t change the optimal solution. We conclude that 
we can assume that V = [0] . 

We now show how to rearrange the structure of the constraints in T(x) . Let us 



- ^ ^ (ix5) _ - 

introduce x « + n) new variables, z and y sR . (Note that z is a vector, not 

a matrix.) We add the following constraints: (a) y < 1 - x, and (b) > By- (1 - yj) 

for i=\,..,k and j=\,..,h. (For simplicity we denote by Zij .) 

m h 

To finish the construction, the original yth constraint, , is 

y=i y=l 
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m ^ n 

replaced by ■ This replacement changes nothing, because; 

y=l 7=1 

(a) If activity j is interdicted (x; = 1), then these constraints and construction set 
jj = 0 and therefore > B^j for i. However, for every interdiction plan x, there 

is an optimal solution with Zjj = B^j for all i, because z only tightens constraints. 

(b) In the same way, when activity J is not interdicted (xj = 0), for every interdiction 
plan X, there is an optimal solution with Zg = 0 for all /. 

It is easy to verify that the new construction fits into formulation [LSIP], where 
y, y , and z are aggregated into y, and A, U, and b, are defined appropriately. ■ 
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